d92fee7766d4e443918ed84ea06db9a0def70fef521510a3216170094f276b89

Sharing

Copy URL Twitter E-mail

General

Target
ransom_file.zip
Size 28.7MB
Sample260913-m4b27aac75
SHA256 d92fee7766d4e443918ed84ea06db9a0def70fef521510a3216170094f276b89
MD5 6ba5d531a28d4cde62975438aa5e73ae
SHA1 84c1a6fde39a6481e553e7322ac163487a9318a1
SHA512 5521bef893ac9dff975f4670cf9cd15380a10da93a6ab392747b40a13f5a5004c7991a62eabe6cc6896725f907381b90f245ede1b643e918a246db5c05a19bc2
SSDEEP 786432:wEqwX3rJan4oIBKNMJaD4tYhlfD5Tt91WrJa3u6INuTs:wmrJavAKEYhlfj9grJavIuTs
TLSH
T1306733767C2E083DD05AA3F878D84FD34206B57208F2F6496475CA8904E64BDF68BB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  ransom_setting\_internal\_tcl_data\http1.0\http.tcl
- Size 9KB
- SHA256 fa7b657aa7d5bbd1bf1e3fbba8bb26fddd6ccff5805625d2e400db5ebe1f968a
- MD5 bef74a91e2e8f1252f594781427a0122
- SHA1 d5e6730f3e65e3b07482f1af9ee13605566adcb7
- SHA512 ffcc7316ae0b7758c4d01a4bcf9c8007ca4e1b5555955862c72520507e55d80da251706310be9db85ed75a6f319879b8ce20bc4b9c9433d0d7c97fda8c80e585
- SSDEEP 192:kipkqA3KsBMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsB8kGJ4kIWPaDFzTd
- TLSH
  T1CD226485620691AD6DB2433ACEB990B0EE3A51B321B9416CBC5DC1643F7250E9FFCBD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1
- Target
  ransom_setting\_internal\_tcl_data\init.tcl
- Size 25KB
- SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
- MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
- SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
- SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
- SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
- TLSH
  T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral2
- Target
  ransom_setting\_internal\_tcl_data\package.tcl
- Size 23KB
- SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
- MD5 6a7b6485d3b290fc5d412ed1d62a170d
- SHA1 50475e80e3969de279edfb1bf8d9c19694c36c0b
- SHA512 36ced797ec18d4aa68fcce57f6eb510e78508d14646cf43ea2effb6f2cf88529d0cb5a4a136fb1252edbb95cba646bdcd19a8cd90a86b19fc28bb9611e2ccb73
- SSDEEP 384:8xgrmNIpEHsDAW2UfnImRqXqQx6XmchmCWhzPLrXJjJh6PLfzd7lG:8xgrmNIwsDnvIm86QGRhLWhzDzJ9h6DS
- TLSH
  T14BB2C821B389915A34B153639B352D8CCF3EC0FF51A951BC78D482BC776092A0ADE7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3
- Target
  ransom_setting\_internal\_tcl_data\parray.tcl
- Size 844B
- SHA256 e269029c8263e3cbc1920c3604ecdcf15edccb208a0d68f9eb42b73954d620c0
- MD5 577787c2f4f5956ba70f83012b980ae5
- SHA1 040b2469f796f3fdfcd1e1dd2eb1c5b799edef62
- SHA512 c2940f6f3d77412efc537b8ab67352f519dffa95739fcc17bf1817335afd9e5bfe91abe98cba99e278cb4923d4e6d431ed9d72282745203c0f7d73193f550238
- TLSH
  T16A011201430160ED22B1C33642E5EA48CD2219361DD66A99F4CB4138BFF1D2486B07A6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral4
- Target
  ransom_setting\_internal\_tcl_data\safe.tcl
- Size 41KB
- SHA256 5359b1a04e22823101661590136325561524372ae0f5dc7dd320422689667201
- MD5 d759c76c507d67b06e97126a04b183c0
- SHA1 4ff9124081fa735b8951e9386a4de11236cefe9d
- SHA512 61100fd6c15974bffd9093321079ec2fc81ffc7ff28403cc456261760afaa02dbaf1421e81aa0c98e52d147c946efa98fc29851ac0a5973fdadf8cce1f711cdf
- SSDEEP 768:H/Jo8y7AyERYhZfc98jlLDRIwEfOtoYx4WneNiBq5vIhNMaqadlUCJyPbb1P6:H/c7AOhZu8jtDRIP924WneNiBq5+NMa5
- TLSH
  T1D11397126B43579D387283329D7AD6A4EF3D80FB42AA40BCB44CE16C3F71419466EBD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral5
- Target
  ransom_setting\_internal\_tk_data\listbox.tcl
- Size 14KB
- SHA256 47c75f9f8348bf8f2c086c57b97b73741218100ca38d10b8abdf2051c95b9801
- MD5 804e6dce549b2e541986c0ce9e75e2d1
- SHA1 c44ee09421f127cf7f4070a9508f22709d06d043
- SHA512 029426c4f659848772e6bb1d8182eb03d2b43adf68fcfcc1ea1c2cc7c883685deda3fffda7e071912b9bda616ad7af2e1cb48ce359700c1a22e1e53e81cae34b
- SSDEEP 384:apDYV5Yupn5OcckwBv3HCpg2J8JvJBfWeZhXkz+WkHGowv:aPPkevB2JuvJ9D3XmSc
- TLSH
  T1246242C42C34637171FFD22746FABB81FF6990A70595504438ACD0A4BF758B246ADACB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral6
- Target
  ransom_setting\_internal\_tk_data\megawidget.tcl
- Size 9KB
- SHA256 848258b946c002e2696ca3815a1589c8120af5cc41fbc11bbd9a3f5754cc21af
- MD5 d83ed6ac2912900040530528a0237ab3
- SHA1 2d18e42a8b96c3d71c1c6701010fdf75c1e6d5d8
- SHA512 00b4cd0d58029fc37820c163a4ae1dead22fb5c767bdc118659eace26d449c362189611dfb3fab1ac129fabfec2ce853ea2c10d418fae5aeb91ddc9330ff782d
- SSDEEP 192:mvEEVwjVwqOpOLbkVAg/vyKEZ25YbKZbwrmQ:mvEEVwJwpALPgnyx25YGZkr3
- TLSH
  T1B1123201638A436F37B763B580FAA154D534C1BF9DEB582C3C9EC3D43B308A286A66D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7
- Target
  ransom_setting\_internal\_tk_data\menu.tcl
- Size 39KB
- SHA256 ae4ee8400174c798337b9c60867cbc94f811b249ebe6dea21ec6f960bcf5f8cb
- MD5 994cbd4038eeef9991f7d6086904166f
- SHA1 24c05d55e80ddc36fd207eeb7c0fa262573d67d2
- SHA512 d1a9c8c89025b305af52f1510b3d4d2a3c556847d345844367ff34c89b917f1646de81f08994ea1697f8f8526d9fd2602f9ac440b52097cab5951901dbbd6ebd
- SSDEEP 768:NKJsOtO4IzOQj4+Abqqzilh5QU4Vjj9eCcYyq4xYpKgnP:NKJsOtiOQEzilh5Glj9eCcYf4s
- TLSH
  T1F00386906E09E3335233D3A683BB9044FF3A92F31346609C745D92AC37B58164AFDAE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  ransom_setting\_internal\_tk_data\mkpsenc.tcl
- Size 30KB
- SHA256 c5bdca3aba671f03dc4624ab5fd260490f5002491d6c619142ccf5a1a744528a
- MD5 983c7b78f1a0ebacab8006d391a01fcd
- SHA1 7ea37474ea039ed7a37bfdd7d76eae673e666283
- SHA512 a006ef9b7213e572f6fc540d1512a52c52fec44e3a07846de09662ae32b7191c5cf639798531847b39e4076bf9dd6314b6f5373065c04f4fef221185b39c3117
- SSDEEP 768:+c4g8rSnBGzHsGK83Ch0x/0kmSq6O4+rNfPCpM2sEmqKys3pCJxi5dEaY:+c4g8OnBGzBK83Ch0x/0FSq6OnrGM2h3
- TLSH
  T131D2F91C97858E6E745222624E3744EEE02DE09E6B694534F9DCCF1D372093C4EBFAA4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  ransom_setting\_internal\_tk_data\msgbox.tcl
- Size 16KB
- SHA256 a07e3a3809ced3c6c9c1e171dca5ad1f28357734cd41b2b9dd9f58085b3d2842
- MD5 217087ab6b2a8f9d7252e311d69c3769
- SHA1 09aeb2bc5b7c7f4ab3de4211d786c519ae0970f6
- SHA512 6e57633c924bfc16d380c014c20dd24d5727e70d4843fcec4d7995b4db21941ea8f2a5fd6e5386df3364b6905d4d66b2b9595dc8fc70cff40a2d49a92a1b6fba
- SSDEEP 192:+haZOxBpK8uxGe4V88/wxY3Fxqipz4zz4zxxFzxT4OcErDxqdRRZeuC/Vj2CoopC:+hRWRG3FFjvsfCoopwITHzLHFHHAABs
- TLSH
  T1787220C673482066B177912EDBE65202EAAD95FB01E0648EBD7D8098EFF1013D1F979C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral10
- Target
  ransom_setting\_internal\_tk_data\palette.tcl
- Size 8KB
- SHA256 849b4c57e4644e51beaeaeb3ae59b7ff067e582ecd10f1b2caf6b6e72f11f506
- MD5 4ce08a10cd9ae941654b8c679df669f3
- SHA1 f1288babca698fd18c3bd221e6ae6c02f2975aae
- SHA512 0f37539da3540e9b1da7b0377e3bbb359b71db4271d63bc9501e95931b4e609e8cb91dc2f7b08a6452598d4a0d58c6a2034049a215000eef0f93a9963d003632
- SSDEEP 192:HWh/x+hFMyTA/CTzxFoUuliRLDm8pQrQlENPyF3o48M6C:HWL+MyTA/CTzvAiRqyEw3ok
- TLSH
  T1E1026112A34952AB72B3A2BA0077F084DA3C52BB515A835D3D6ED1F8373043687FB6D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11
- Target
  ransom_setting\_internal\_tk_data\safetk.tcl
- Size 7KB
- SHA256 579701605669aadffbcdb7e3545c68442495428ee6e93c2d3a3133583bcd3d33
- MD5 21a3ac11146ec26784c0e729d8d644d0
- SHA1 c7e0918e8692c42c1d1dd1bbcbfff22a85979b69
- SHA512 724ed83b989ad9033bec4211ee50e4c9e85b51054c518cdf7e02d0ed0416f636b9f38c0b0d29f8f4f7f465b77c7d2e01d0918d2c2c3fec4c7739ea982302fa2e
- SSDEEP 192:Eet0t8bm9Z+Yjo+j/YKOtOUOtk8XKUal320:EetG8biZZs+bIAUoxX0d
- TLSH
  T104F17490D30317D6327142A25B7AF3A5FB3500A756F762AC7C8D826C7BA7417C22ABD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral12
- Target
  ransom_setting\_internal\_tk_data\spinbox.tcl
- Size 16KB
- SHA256 747889c3086c917a34554a9dc495bc0c08a03fd3a5828353ed2a64b97f376835
- MD5 eaa36f0aa69ae19ddbdd0448fbad9d4d
- SHA1 eb0adb4f4d937bac2f17480adaf6f948262e754d
- SHA512 c8368f19ec6842ed67073b9fc9c9274107e643324cb23b28c54df63fb720f63b043281b30dbea053d08481b0442a87465f715a8aa0711b01ce83ff7b9f8a4f4c
- SSDEEP 384:IMpfyeKu9TzD0E8+9T1wqBaQKpiqQr7E32fnzXfWJU:IMpfyeKu9Tx8WODTp2zPP
- TLSH
  T1EA7233DA2D14632D6173C33792BBE305FA2690B7569F40203469C1943F7AA210ABFBC7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13
- Target
  ransom_setting\_internal\_tk_data\text.tcl
- Size 34KB
- SHA256 f7ecc5ae6eb297c79aad5cfc200b29c4e72409641fa369c5cdbba30ae41e982a
- MD5 016613531555c4f30f670dab58f10b3d
- SHA1 3afc8aa3e10950d79d1003b0810f2e0dc2135eb9
- SHA512 c5d071fc8cb68c5985e74ab7e90367e9261b291474689c37abd7f921716053e9d5e9446a45c5e91f3bb927589270e818e22e2d675acbe04e0627ecd5d532bc05
- SSDEEP 768:Rp4LaQDlOrqquMwIMyv4Et8rvJLgmTGXs1bYMeNnnZl8n6KRD:RYK8rymTGs1b0xncn6KR
- TLSH
  T1E3F2769928095B7AE533C372A37AF101FE72517B06C28119749CD0903FBE46A877EBE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral14
- Target
  ransom_setting\_internal\_tk_data\tk.tcl
- Size 23KB
- SHA256 b7fd24177b17f67da2ca671f711309c65cf246be1fd0cf4f1ab8f3ea9ca2c3f1
- MD5 7e46d32c3e70dbf17663f57e17d18dfe
- SHA1 394dd3cde6a7e41855917060f4388478a0a84668
- SHA512 6125e9b6c213e48e4a7a47acc0be3b930ddd9aca2132817f1906a2453e0d0b8292e7b2090bab8712856d12d2cf4d119238f16fae0fb57dd66da4db8fb3d92b0d
- SSDEEP 384:Nbyxt+WaB9USY15gSgC3DbTbXLXKr3aIIXyDAbK2LMGgtewT+3oFQRyH5bAy59HU:NbItNe9USZbeXysm7GgteoFQRYMESL
- TLSH
  T11DB2D5195DC062B3513BC12F53BB2A00D87558FB2B76A84978DC48B93F6483B06FE9E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15
- Target
  ransom_setting\_internal\_tk_data\tkfbox.tcl
- Size 38KB
- SHA256 baf1ed7b617fb64ca097e81059454783c4d922999e19000cf2953cc09c8f4505
- MD5 57d60d17cd3ef211d18bf4f82586ddcb
- SHA1 0a7415ea599725f81118f4b833c4fa1d601d7ba6
- SHA512 d3279d24885cb0c4e72fa0c3783fab215a32dc591e367c5640a3fdb1aed33933504dddaabce98455b485b68bca3c75a97249eac40abeee945b9abaab7974ee0d
- SSDEEP 768:+oj+Aq49cn9tJNgDt0/vsKulXgo65Eh6pQb:+6+ZT/ggEdio65Ehdb
- TLSH
  T16A038412734C6236A2B793339EF95024DF2AA0FF5298525C746C40AC7F31136ABE97E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral16
- Target
  ransom_setting\_internal\_tk_data\ttk\cursors.tcl
- Size 4KB
- SHA256 5b33f32b0139663347d6cf70a5a838f8e4554e0e881e97c8478b77733162ea73
- MD5 1a799fe3754307a5aade98c367e2f5d7
- SHA1 c64be4b77f0d298610f4ee20fcebbaee3c8b5f22
- SHA512 89f367f9a59730bcdfc5abde0e35a10b72a1f19c68a768ba4524c938ef5c5caf094c1bfa8fc74173f65201f6617544223c2143252a9f691ee9aaa7543315179f
- SSDEEP 96:DRYEqfLDxGmxGUetobPT6t6brv0q3O4Uxz0:DWEqTDbxdKobPqe5PUxw
- TLSH
  T139A1651F358B10A77F71016699F6D44BEA06F377CA2AC108F58F495C7FB8281049197A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral17
- Target
  ransom_setting\_internal\_tk_data\ttk\entry.tcl
- Size 17KB
- SHA256 f2cacb1b3a941cc7079627644e91f0d4729bf820c481c8ce7fa28c952b803e4d
- MD5 dbcedd7bfb63a55c210c25dcf230c657
- SHA1 b05cf01453a22016995627176f6339068c58ba01
- SHA512 7f8e9a7d80b463d9cec791ef59b1a27f8acec95ceede45eca06c4dbf9ba805c2c1aee19a0118709ee47768f1b735a74a32b35fb9d8559d94da77c71e4ec5d117
- SSDEEP 384:sca9Jzcyzf6yzQO+e+iPT3vKof8q3YIuR13a:sT9Jzcy76diV3YNa
- TLSH
  T1A48294E726121771A5F30733EEDBA045FE1A98BB378281153449A3543FF4111469FAEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral18
- Target
  ransom_setting\_internal\_tk_data\ttk\menubutton.tcl
- Size 6KB
- SHA256 0935fb97b6628f055baeb2e2babbf2a6c8905260e1107972b0e7a1df0752e180
- MD5 aec91dd23de04196af5eb31e8bbd0946
- SHA1 bdf5a5a42a147d7484e5a2966ea949fa68f52348
- SHA512 6ea4a2ec378e6cbabbf8ff20fb1cad0c68a90e5089f20d195fef2ee4ff9259bd3b622378e7203bd238402140f7eab7e316b8a8f9c4b6c0d3d3acbe81f0a25ea4
- SSDEEP 192:toMcJQkmcE6fNuLyiCzSLSRwgppdT3kXdpK3dSH2tOTjvAG:tRc6kFbcH2pyXz+E2y
- TLSH
  T1A1D1469127047326A532A37683FFA058ED2FD175774AE49C3446829877E142A0AFDAE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19
- Target
  ransom_setting\_internal\_tk_data\ttk\treeview.tcl
- Size 9KB
- SHA256 c88b60ffb0f72e095f6fc9786930add7f9ed049eabc713f889f9a7da516e188c
- MD5 f705b3a292d02061da0abb4a8dd24077
- SHA1 fd75c2250f6f66435444f7deef383c6397ed2368
- SHA512 09817638dd3d3d5c57fa630c7edf2f19c3956c9bd264dbf07627fa14a03aecd22d5a5319806e49ef1030204fadef17c57ce8eae4378a319ad2093321d9151c8f
- SSDEEP 96:FoTvMxHZZ1u2xj7+ZBHxjiXJv9IfwW+vr3UxjXEJDTF/MyLF3JcMzlsra2tYGa5P:mImAkRKYXMH59o4UbS30LWb
- TLSH
  T186221FAAA5816271DA767632FEF80166FC1271AB93C6C48D344DD4643FB006188FE9F7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral20
- Target
  ransom_setting\_internal\_tk_data\ttk\ttk.tcl
- Size 5KB
- SHA256 685398e8db93aebbabfed795e91a42a87aa0e2a2cf23bfcffd70fea085a7ad5e
- MD5 4a81a6219cfc1b056471d07624ee3dbd
- SHA1 0a8e6b4a38cdba6a325d8668fce3442217392e8a
- SHA512 5917febd222b1ad14ca871c11817d875d1ff019256eace148af49ba24be8f8fcf75debc40c6ba54368585c711dd9e056054bfd4133ea672f27d34a3d712bad6e
- SSDEEP 96:lfxukTy5jPTq8LIgF2diyNTNR6nkrpM9a4ijSSvNigyJ5612HtZG835MSvWOTRsp:BM+y5jrq8G/2nki9JijSSvNigyJ5612e
- TLSH
  T117B17739A70EC1555EF142324B788168EADF7AB113510C08F8BD81BD27351778EE9BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21
- Target
  ransom_setting\_internal\_tk_data\xmfbox.tcl
- Size 26KB
- SHA256 c4722eadede763fa52e7937d40067b0f8eb86b7a4b707f90212ed3e5289690d0
- MD5 fa99ef44faa88a6ba1967a1257deb97b
- SHA1 cc99dbf678f4169a90acc5a89c6f8dab48052ec6
- SHA512 3af16095784908a444cd61eef178a30b9fed9c20aa91d94044a3aecb6047267fb80bce790fc1f28fb19aef664a6618fd832612f541fdadcc34b6c01e92e5ea40
- SSDEEP 384:0BLzjXhss64XKNFXm39QJ63nwFiHLgRIdNPCRE5phLtffsNP4XWdxWk+I5oP9jNR:0BvjXoFCB3flLCRE5phLCP3xWq8vWTod
- TLSH
  T1C8C271017248572245F35633CEF89699DF16F0AF12A9521C794C806D3F3243AAEED7EA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral22
- Target
  ransom_setting\_internal\_tkinter.pyd
- Size 67KB
- SHA256 574549683a4298335bdb8761ec6eaa11d56e366b618b5ab0b701b5fe2dda48aa
- MD5 3aa9cd197097575a1cd85c4b60b1489c
- SHA1 973644b7c6c66e0c0ac0bb6f82600c1e62669ab8
- SHA512 b616be273ac160f3c344fee6506f3f90948aa2fb12ac09da5a02e3ef8292614d7257a91b5607978675905ee377aef0640e75d43b5ed70d3799313a6793f17607
- SSDEEP 1536:mxIxVo3bb7sOOkQ48jV3RNEFlU9ow9oVZfd2TkR9IyvSLyrcz893fITZ+7:maerFQfulPdVZF/9IyvSVvk
- TLSH
  T1AD638E9BA7A4008BEEE3D539C4739B13E575B6924A14924F01E4D34A2F333D3E7AA714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23
- Target
  ransom_setting\_internal\api-ms-win-core-console-l1-1-0.dll
- Size 22KB
- SHA256 015bd08815c7b934a8952c3a7578e9ce59f21136e8a880d42bbd414bec2c6058
- MD5 5b90d640caf3b0d30f15d055deeec95f
- SHA1 94f0be1e732c671c553523a2bd7e936ceafcbbc3
- SHA512 4d35b924d39b73f9d3dc20ed14f213267b2adb9d08884967e5e58dce58d8bc701d0f36e4598d0ef94b61a9db9d898d923a5e9316399401654d8fa5f08198ac85
- SSDEEP 192:yLOGW8hWHca8LxydkeR+TqMUGVkQKgvkctX01k9z3AwlU/q6c3b+l:yLNW8hWHcaGAOqM1+tGkeR9zxUSdq
- TLSH
  T1D8A24BC34FB8A042F9AAADB05794EA533C3DBBC71960D95222D4F10C2CE33D19B1462E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24
- Target
  ransom_setting\_internal\api-ms-win-core-datetime-l1-1-0.dll
- Size 22KB
- SHA256 5534812cdbdae94ba45cb216e5eb9af686b853948df54365103555abbbaf9d9a
- MD5 947918e1693507991617c90a0021edc4
- SHA1 70ed1dd9f7e1ee0371a3f21804396ca1089e6bb0
- SHA512 6eafed6e94c65313692d899b3c81d39ef2cda98913d2ee982e5fafb49930653538ce788229d956bd16ca91e6b4a5057ca332e0a1c22d1ebbebf51fa0d5ac7a21
- SSDEEP 192:iW8hWrca8LxydkeR++W6hnvM30LRLLX01k9z3AvmSfOc:iW8hWrcaGAvBhkELRPR9zWmSWc
- TLSH
  T167A24AC2577C9042FEAB6F7052A8EB437C3CABD71990D52215D5F04818E77C9EA10A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25
- Target
  ransom_setting\_internal\api-ms-win-core-debug-l1-1-0.dll
- Size 22KB
- SHA256 837d2b1b2cd03e03fc6ccb050698b6b5763af17c201304872342a5eae9e0a2d2
- MD5 185aee5e17fc88d4d0e902586fa4a7b2
- SHA1 15fe822b234db9867e6b20e2ec82c872f733d2b5
- SHA512 8e933263a5d34e0d4121ffb9524128a46dc0a1f3b3448881a4590cfd205ec01958fce592fb3426b8343b073fb05b30bcecb64ea728ea020c3b6637848618eb20
- SSDEEP 192:QW8hWnca8LxydkeR+EDPkyv8xYqD0cSX01k9z3AOcnIVD:QW8hWncaGAVzIvDyR9zLcoD
- TLSH
  T19AA23AC65B7C9042FE9FAE7042A8EA837C7D77C70D90D9511698F59818933C6EB20A3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  ransom_setting\_internal\api-ms-win-core-errorhandling-l1-1-0.dll
- Size 22KB
- SHA256 de43b165f568c276c00e95acd454e3092f352a18e95874595f4f4658c06d2ec7
- MD5 8c6d631ee09889816ed2183ab6277903
- SHA1 60df613618dd33da088d2e3d9c57a57f00d4579c
- SHA512 9ad2e7c30d2b0215c071242a67b41447740433987c819f23ae9c5518369ef0504ca045ee27bf53ca93d7a2fde3ba062f291a5c97196cb94c972539c378923170
- SSDEEP 192:QLmxD3xeW8hWBca8LxydkeR+xvjr3u59xHLy2j/X01k9z3AP1NdL:QL+eW8hWBcaGAYvjSpOE/R9zM1j
- TLSH
  T122A22AC29BB89043FAEB6E705294DA837C3CA7C71860D56656A4F5542C933C5EF2063E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  ransom_setting\_internal\api-ms-win-core-fibers-l1-1-0.dll
- Size 22KB
- SHA256 3cebc45bf479ad74cfabf2c6bfd4994d7ad639ed1221025981d19cedf9ce0416
- MD5 7d3bccee91add398a534ccf822482bb4
- SHA1 911e23262b061fc7a1b94c699c16054f9eedf8ab
- SHA512 4aa7e163c9bb68710cc89ab317a5a9e773a09bda3a25fb7bbb9a2054dec66f3ff7330d401d5d1ed7b75e9dcf141af0b64687263bf14cd86380208ced94b647bd
- SSDEEP 192:FW8hWazca8LxydkeR+al/+TYeds/FqX01k9z3AqgDJPdb:FW8hWgcaGAjl2BR9z56X
- TLSH
  T10CA24AC2673C9042EDEB6EB052A8EA537C3DABC75D90D4561694F1041CE33C9DB15A3E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  ransom_setting\_internal\api-ms-win-core-fibers-l1-1-1.dll
- Size 22KB
- SHA256 5ef70308bcca628ce6b0e2856b15b1c7ae340c3f9bbbc4c1071d8c191a34a5c3
- MD5 3a17e0366bff65ec11edc709e6048ea9
- SHA1 54af2275679e8314f88211595a85e9be6d8a8c3d
- SHA512 95310331a9376b628551f7a7bc0213f23a7220a50d4bc214cff8767576a1dc97cae00ef502ec21511315141c1926d5c1043993846a40c180cbb45d8e7e467927
- SSDEEP 192:ut+bW8hWCbca8LxydkeR+eBGejgdxP3NGmVX01k9z3AAsH628:uuW8hWCbcaGA3BEP3U0R9znsHu
- TLSH
  T1BEA23AC25B7C9083F9EFAE7092A8EA933C3C6BC61980C5691590F5482CA37C5EF1063D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  ransom_setting\_internal\api-ms-win-core-file-l1-1-0.dll
- Size 26KB
- SHA256 250ac829f2617bcac1c6e5b8c4f630462e20765863ba573526a3e11bbfb94a9a
- MD5 4db29c0bc345edb80b7a1001b6aae274
- SHA1 32eb82d2eece0b427c1d4604c71820024da87b6f
- SHA512 3f871f536ede01f87a8ccaa42303f4a082308f58ba6411d75eca5438627ad508807cbcd99462f709cf805feede1d1828c08b0ff16bc09ec2e782dab24780117e
- SSDEEP 384:eJPvVr2W8hWrcaGAf7pofngO6HVIBHR9zvObcv:eJPvVrU6bdeglKf9z9v
- TLSH
  T1B6C21A87D6B4F24BFC8F9E7151A2C983683943C6482095C62BD4935C3CF738AE79859D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  ransom_setting\_internal\api-ms-win-core-file-l1-2-0.dll
- Size 22KB
- SHA256 ae14079a114733f60ce87b92cba42acd8083c2cd67594e53bc37dc0b97a4b465
- MD5 a0cf8a203637f7eafadd899cb15c53e1
- SHA1 abb3db8003bce66fdbddd2177eba39a4b9db5f8d
- SHA512 f4fbf1280bc7275f1b4d1ccee7c46dc200510837ac1f67b1e45a9a59ced2ee15c8f070dd96a5cf823a8227b8279b78b7394251888a3d2041b414f6241d4d6f45
- SSDEEP 192:Tt68iW8hWaca8Lxyf7LRroihrSeJM7i/FqX01k9z3AqgDJ3:TViW8hWacaGAf7pofeJMPR9z561
- TLSH
  T14CA24BD2573CE042F9AB5E7092B9EA637C3C2BC34990D15719D5F0581CA37C9EA2872C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31
- Target
  ransom_setting\_internal\api-ms-win-core-file-l2-1-0.dll
- Size 22KB
- SHA256 914bf26a298713119477ea0a8e7bd43171b91344ebe24fb47ad77c49686e3d87
- MD5 7688ad91734b26a7b9b1787c7b1a73e2
- SHA1 87d7e07f2c04a1a0fba9d213526430a538020a69
- SHA512 e4be6696fa2a13b7943246786ad02ac03d45c35082eae5294516818ad83c8b6f88d1f9d4a7aae261c0054688165bd38fde2daaf514bd2533f3a776f9d5eb7948
- SSDEEP 384:DAkW8hW74caGAf7pof2DvIpGR9zHUsh9x:Dnbde9Y9z0sh9x
- TLSH
  T1D8A24BC687B8E043FD9B6D7082E9DA433C3D6BC31E50951706D4F1582CA73C6EA2466D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Command and Scripting Interpreter: PowerShell

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Command and Scripting Interpreter: PowerShell

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21