d401e41c0a1a3503457292d8d986bda9f781cd10ca5703d17fff89666a46a2ad

Sharing

Copy URL Twitter E-mail

General

Target
LTTSDirector7.rar
Size 49.8MB
Sample260928-1wafaadd76
SHA256 d401e41c0a1a3503457292d8d986bda9f781cd10ca5703d17fff89666a46a2ad
MD5 9c551a2da0a71189d7168948c9d339d3
SHA1 d1c2aca0a5d6b4d82c3854304ee47abb4563b443
SHA512 24acb65d78e4f0d93b5ca685b1c2a766308b7e35a66bc8dcb56de21cf2c9e29e7c3f7b2fe7b083167f955b7d911e236dd625831bcdc66482c03f2aeedd037f08
SSDEEP 786432:KG//0UcWRwqdpXIYJuM/rfBCB/M4IBb8KVFjDXxU9DjDgCXYjWPiv+RH1ce8VbbK:iqd7Juh/M4IJ8Sf6JjDNRPiaH1c9b4f
TLSH
T1CAB733CD0E1DAED75AA935239D159190C833ED7C89CB40A875330AE117FFAB251CAB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  1.-LTTS7 Engine Full Distribution/LTTS7 Engine Full Distribution.exe
- Size 14.8MB
- SHA256 2bcaaae78e79d37e344760e51b3fabde018101ffabb2505daf47c5d5a35191ba
- MD5 19c968b35da20bf0acc3a00bc11e0132
- SHA1 6336bf10960f8c8db4206d570ed65e7b15cc1742
- SHA512 37d6c31ac9f94d97101868ce47e2697e1d8b1fe2bd3f67862fb8ef8efd10f86a9abc631bd8895061c28b060d4a7b691797f7c12cc846d79a52bb6c14a3aa23d6
- SSDEEP 393216:SA0TTnrZru9s8Gnj1aoE4s8Gnj1aoEfP05wUjVG7h:Svnr9us8EMoE4s8EMoEfP0SJ7
- TLSH
  T102F63347BE55C231E04A5A3EEC868BAC86227C96DF31A00337A43BCF36B61D55C753A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  1.-LTTS7 Engine Full Distribution/spchapi.exe
- Size 752KB
- SHA256 ec385baa8011c7b23b5ab8947f109b8e298f6adf0fa3b9eb6803db8d020afa2b
- MD5 b527096c844e4f54efc794cf306d84aa
- SHA1 0ac9856cca0e51aa8b7b82600266a9e7863753e1
- SHA512 b71b8a15f63081d17b06930eead27a7f13ded52b1a62bcaf54f3d8982bd370a083ff8f371a514795c6c8c4ded3a7173e90eecd56da9156a1b6d0039b36a9dbae
- SSDEEP 12288:PCwEWTcBoQfTpGyaQgmYbsWE3J1LxrDXSeGWcLLXEUzlamHVl8UzdXZ8EHF:PcnoUTpGyaDmCsl7pCfWcLLXEIvKg3
- TLSH
  T139F412525AE3857BEAF167B40AF006A36F737CA04FB9E74E6281D46D1D33440A934367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Loads dropped DLL
behavioral3 behavioral4
- Target
  2.-LOQUENDO TTS DIRECTOR 7/LOQUENDO TTS DIRECTOR 7.exe
- Size 33.8MB
- SHA256 c0d23ea6a596f8a4c77563028a45c51ca077df22f8220b6b18d4ac55b5de5cb7
- MD5 f575b9198a334b3d74c8d624fc03ac79
- SHA1 a61577f823acdc747de35cc4cecdc653067905c2
- SHA512 96950b0709f482b8e0b463db1df98bfbf34d08b0fdbcaa6fd199fae58ff9b863b9a032eed4771daf5358810b0ca0fcabd68fed6663a87bc9a2b497911406ff1e
- SSDEEP 786432:MOMQ+f5wha0O+pZIAPGEJRz3xGlmjpR9EhUqcGrZx9T9JI:MOY5UIvQhGmEhUqcGlT
- TLSH
  T14377339AF5064432C914B03A8A675B6C1A736C93C513151F37B47E1FAEFB3E0A6B118E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  3.-LTTS7 Spanish Distribution/LTTS7 Spanish Distribution.exe
- Size 2.2MB
- SHA256 4d599c0470dff1b3bcc048d05b6c8501b45cbfd14237620c2cc367b11667a5a0
- MD5 de7d84f5fe0324b322dab057918e1e07
- SHA1 6f261d3eeba103ceb2fd3be83c91d1e9006a3c8e
- SHA512 5f6364c66726354c8a300cda3ce1d447e2bbf9dcb21fdde61e9d97c9e4cd3dfe2148b692ae7dadd593f49d9fdf899f10958a861d84c44b0b6e47d4e7a3443706
- SSDEEP 24576:hvGfC4sXKyfOMzpZYj8kufL4VYBxhvLcAWoEKqc7IqXo/0b704LRYzJec:hvyCRjZYA4VKx9TSKqIIqYsb7vy
- TLSH
  T186B5010777C2C771D94B12718A1B937A4A72DC248F314E4337A87F0D3A712E5A6B62DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  4.-Parche (crack) para las voses/Patch.exe
- Size 402KB
- SHA256 3d659b3a032fc9a9159cdc25eb1f887e9c6c5447834dc088b063feb0d0f79538
- MD5 321e5b68fe3d5be7826e49c9bfd284f6
- SHA1 80c9a6d77fd25da26a86952a5e6b2104cc768ce8
- SHA512 76963ae4cf5c21929b6737b0a92d76e89d5a3d8490013d27aa6b6d64414eb83b4166d8bf2874609b373d9bb2581b5f34f01dc30aa95d1d90fa3b708608cb5450
- SSDEEP 12288:Lm0xFcvXi7DwXp6BVEtIv45YJlVtSPEkwOrRA:asiv4wXps6tIvZPO1
- TLSH
  T1E9947E26F6E08437C2632A389C5B57A4E839BE503D296C873BF81D4C4F7978139692D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  English Distribution LTTS7.exe
- Size 3.2MB
- SHA256 ae319ea1b7793a590592f482646a39dd7a7e212b1571ba5fb7cff6258776398d
- MD5 91117aed2648185ae1eb6a8abb5cd184
- SHA1 b61366ec849b7d002d946547f0b65b723293e4e2
- SHA512 502adce355c437832607943edc7461df66cd16833a265ed4e0817ed154a0942c9f8393c0f1db4151428df54fbcdb44d1efe65fa1e1abb8fb6f9dad0b396e918e
- SSDEEP 49152:NfyCRv6M93kaLZux3GLC8QgRGbUkl5c/QBo5/69cnAuIqZBb8vy:QIl0GLClgYbO/QuPAu
- TLSH
  T114F5124B7BC2C772C40E1671850B476A4A3ADC248F604D9377697B1D3AB12E97BB23C9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  m3troid300.url
- Size 126B
- SHA256 941a56fcff9686f45a409d18a2ad75e1ecf38fa530f62a97a6efc692f1a469d4
- MD5 c44326939745f2eb5ce27b7a135bd482
- SHA1 fc3f8ba0232709a3c3a3746b0e45475b7036b0eb
- SHA512 9748ce425565cf51b83d1caabae215ce0f2de575920642249c7a53580754b06af98a75354a3b95ca186742f9df9c5fdd8b4a6db23a0c9abfab7b59c9d7eac159
- TLSH
  T1C8B092204D4C82EAD5322D8D61628ABC968A92A984E2CAB8564CCF9B606EE137098120
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral13 behavioral14
- Target
  French Distribution LTTS7.exe
- Size 1.9MB
- SHA256 74fc1ff1c154395949311a82d7d026ec19cb63dbd7c58436a27409b1c84d478c
- MD5 0c91434f53e908fb59f6e933d43225ad
- SHA1 f312ec930cf3d4affa0dcce45afc8a4a015e1ba7
- SHA512 f11c063028a703bf0cb838ceff4fe7c21982fdbb2182653bf599a6574c61e48387ed421d33b60a34230e2078c47d955f2deebe16d154e5088cc567dec5c42550
- SSDEEP 24576:V/Xj20AI+4YKIaM0qY5IqXwsbb+P04LRYzJec:V/z2QJIXY5IqAobuvy
- TLSH
  T1E795F10776C2C7B2C84A1275891B97798A36CC28CF314A5373983F1D39712E66BB63D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  m3troid300.url
- Size 126B
- SHA256 941a56fcff9686f45a409d18a2ad75e1ecf38fa530f62a97a6efc692f1a469d4
- MD5 c44326939745f2eb5ce27b7a135bd482
- SHA1 fc3f8ba0232709a3c3a3746b0e45475b7036b0eb
- SHA512 9748ce425565cf51b83d1caabae215ce0f2de575920642249c7a53580754b06af98a75354a3b95ca186742f9df9c5fdd8b4a6db23a0c9abfab7b59c9d7eac159
- TLSH
  T1C8B092204D4C82EAD5322D8D61628ABC968A92A984E2CAB8564CCF9B606EE137098120
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral17 behavioral18
- Target
  Galician Distribution 7.7.0.exe
- Size 1.9MB
- SHA256 cf31500d2f03b0248a0d70ff9610fcdadceef111ce1676bcbfbe87814490a9d1
- MD5 f1108ab3da53474554f3c3dd21dc80a8
- SHA1 c70320378d804a4d6e28c1a8cf7134ba0f30144e
- SHA512 316e74e8bcb81109347ab402921245fcb7fe6718fc65c87a12b513afa94dd3327d9243ecfbf58f3bd9198daeba6ae72e2e4be5f45328314662bfc2985b69eea8
- SSDEEP 24576:nUf5xPXp9KhsjtDDes/ByQddVopzV2j3CIqXl4bep04LRYzJec:nUfTPp9KhsJDakByA82LCIq14bAvy
- TLSH
  T1CF95E1077B8287B1C40A1275891B93BA8B76CC648F314A9337583B1D3E712E667B73D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  m3troid300.url
- Size 126B
- SHA256 941a56fcff9686f45a409d18a2ad75e1ecf38fa530f62a97a6efc692f1a469d4
- MD5 c44326939745f2eb5ce27b7a135bd482
- SHA1 fc3f8ba0232709a3c3a3746b0e45475b7036b0eb
- SHA512 9748ce425565cf51b83d1caabae215ce0f2de575920642249c7a53580754b06af98a75354a3b95ca186742f9df9c5fdd8b4a6db23a0c9abfab7b59c9d7eac159
- TLSH
  T1C8B092204D4C82EAD5322D8D61628ABC968A92A984E2CAB8564CCF9B606EE137098120
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral21 behavioral22
- Target
  Loquendo TTS 7 Installation Manual.pdf
- Size 341KB
- SHA256 4db561b41df07ac2feb7e522a9a7e47ec82392e7be602f207f2b84b6a656aee3
- MD5 941e363eac67f394e298c68ba1ed0332
- SHA1 5b6245c4c4882f394ee30bc5fa0de1e139a159d8
- SHA512 db173c272060d8bd68f7271b95f80a68b94af91554452381bb68ea5b4095c5f27ab21f08a270a0ea62239e9bbf380209b15e50411f5767c99e94fe25e4a00087
- SSDEEP 6144:HpzpZwCO9q05dryibndMnego9fZTOyQYoCQhWNxw6KBqtjtgPeuFrVPieLM:ZblO9sodMnCXTZQkQIN2vBwtgdRPiiM
- TLSH
  T1AC741235DA44BC9CEC43D586976639A4870EB273B6C478E22C6C0D87F885F86D65B383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

adware discovery spyware
behavioral23 behavioral24
- Target
  Loquendo_TTS_7-Win32_German_Distribution_7.7.1.exe
- Size 2.3MB
- SHA256 15af288560c759941ad983ad6b93a1eb1635c0e0b830de76057dcc8531cb9d65
- MD5 20068f260997d04af41255c338e59588
- SHA1 02cc43132253d0ba489baf9794d4b36fbea0914d
- SHA512 03f929d5663159602113b424a5eb4b4f1223826790a86972f0664cf14f90ce1ee5cdc925f1a8e05d98e4a723e7367903b4fbb0336fda922f027d14ba88d8986b
- SSDEEP 24576:mrJVwUOHrPOUkZ5mDl3mqPTvjGC6q+leKzxYlnjIqX+9ubn04LRYzJec:m8/Tk/I2qPeCjVKVYljIqukbnvy
- TLSH
  T1B6B501077B82C771D80B12B0895B937A8A3ACC188F354D5377A83B1D3A716E567B6386
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  PORTUGUESE DISTRIBUTION LTTS7.exe
- Size 1.7MB
- SHA256 fd82e5ead0ade601dc8fd93eafe62652834a061d7159653450a213f80112bf7d
- MD5 e961cb98ef141e0c84cb7e65de192998
- SHA1 507fc6994a91b6e4ff43880407bc845713d2ef3f
- SHA512 09fe48b01aa700edfc1f4f2d8dda0ed8004bf458b2cb73bac299db2996210187be5d3e40318de491b960c74bf6e03b94890e0f31740ace7a6e9aa1446a2a4d43
- SSDEEP 24576:3QGfC4sXKyfDirRFMAFn8IWykIqX6imbtv04LRYzJecK:3QyCRdi3+IWfIqqfbRvy
- TLSH
  T19885E007B682C3B1C44A12754917937A4A76DC288F314E8377987F0D3E712E967B63DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  m3troid300.url
- Size 126B
- SHA256 941a56fcff9686f45a409d18a2ad75e1ecf38fa530f62a97a6efc692f1a469d4
- MD5 c44326939745f2eb5ce27b7a135bd482
- SHA1 fc3f8ba0232709a3c3a3746b0e45475b7036b0eb
- SHA512 9748ce425565cf51b83d1caabae215ce0f2de575920642249c7a53580754b06af98a75354a3b95ca186742f9df9c5fdd8b4a6db23a0c9abfab7b59c9d7eac159
- TLSH
  T1C8B092204D4C82EAD5322D8D61628ABC968A92A984E2CAB8564CCF9B606EE137098120
- MD5 SHA1 SHA512 TLSH
Score

4^/10

discovery
behavioral29 behavioral30
- Target
  Rusian Distribution LTTS7.exe
- Size 2.1MB
- SHA256 af32a4b938cb7d6e478a2b35ee5f6ff018d7a137918ecf922e5949021199869f
- MD5 e173c335e7c4f155cdc6125d4f36200e
- SHA1 ebb995c01b665ed18592af73fe25d87654baf1cc
- SHA512 1693063d7ddd042625ee67a12d6834163b55917c2676eff08eafa7cb8623b6bcc0611a19543de164a96ab2154d855151ec583c8dbe7df22f65f8d74ad054426f
- SSDEEP 24576:qvEj2srLDmFiyCofs71HHZxrEonrmUIqXUhS5bJ04LRYzJec:qw2ALDvyC+OXvhIqikbJvy
- TLSH
  T194A5F10376C2C7B2D44A1275891B97AA8A36DC188F214E8337993F0D3E712E567F63D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Loads dropped DLL

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Loads dropped DLL

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

Checks computer location settings

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32