b8941585f39eee6b3d2badf71255e6fc5103cec89d785c6c9d6720a4a8ddf8cc

Sharing

Copy URL Twitter E-mail

General

Target
b8941585f39eee6b3d2badf71255e6fc5103cec89d785c6c9d6720a4a8ddf8cc
Size 15.9MB
Sample261002-l5ghmafd73
SHA256 b8941585f39eee6b3d2badf71255e6fc5103cec89d785c6c9d6720a4a8ddf8cc
MD5 d194695cfa687487bfc767af76020889
SHA1 7a1b4bfe2afe1da025607b3aa67be09f7b3490c3
SHA512 e9c21cfcb90aae4cf77562232b4c48672dbfa864229a71244763c1f9b9fc529f92c299dcef991f8d019ca36346fdf885e14b174e2311a3279cf917fcb75a04ab
SSDEEP 393216:jzH6qkbdILa5OSOU/HuTSwd5nUOc5RfFVifnNEbUPVa59RL:j2qkbdPH/OT3vtc5RN4fSH9RL
TLSH
T151F62220E1AD2502D44FE0B605B7295407E29D34E3A95BDBB33D3D4FDD93E6B2E50A22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Extras/AutoItX/AutoItX.chm
- Size 195KB
- SHA256 3f8cdc4609d70414239b578b5f87f495b5dbd1e1133d5d05d94b39258b807eda
- MD5 592e7a5c737c2d51c4a9905c92e04a20
- SHA1 7cdaf547bbac165549e99ccd371e838180c1ab35
- SHA512 8cb2f86ee8e00ae232d5a071f6d60f3c6b4c27d1328073a1ac82aa639bbf009eefeffdb464e770ea26d34a7fc9393741b6dc2f8b8dc32df36302631792b5f667
- SSDEEP 6144:p3ximAlAnCm7subS6XSPrIItAv+IHDSmVI7/j:xsLllmxbS6QrNAv+IH2mV0j
- TLSH
  T1DE140209813FF932E878DFBA33868E6D62D0CC1955DE2E09E465526A80D7FCC7421D9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Extras/AutoItX/AutoItX3.Assembly.dll
- Size 43KB
- SHA256 a5990c26108d85eafe9b2b512ad43438b4976321bc020011e2f676e861912268
- MD5 291f0704eae460044e0ddbb2e8eeea69
- SHA1 f60d2b1d349cf087784a80826e9c5af7c30841d2
- SHA512 3334904f5088dbc7c1c4557e27670b3b76e591c9f80e96b8e394a0070f321bfef243a2c4dae28e3be4b12ee8d7a86c9055207d5dd24ca239b073098e7a71a422
- SSDEEP 768:bJ13X9fiSRxLr80808goIw48AU8fPDj8cLfHzL/LigUUMUEcMtttttttp0rg++XO:rteKHdSt2giFP0JD+
- TLSH
  T1FF13E995427E1026D78C2A3EABA2BFD5F731C2A1869703526171633167F338C793DA87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  Extras/AutoItX/AutoItX3.PowerShell.dll
- Size 52KB
- SHA256 cb95a6ac3aa37eab00c2b928ca081f4ad459eef5061e50696653a29f7ee6963c
- MD5 62c3dddf643e4f9f1d6296bc8272a5fc
- SHA1 d2d70e7f12a828ed08e514b469b516c8a73503be
- SHA512 f9666f6c67248d5771b450db72d83a7961a8fd417bf6a4831d4ad9a61adf6ed71cca5f58f960ac51a752ebdfbd704ad8797b97d8191249e26443ecaa92b1c9ba
- SSDEEP 1536:R96dbrZ1PFtFR0Y9kTUDYvCtbd+2mPP0DT:LObr/H2WYaT+2mPP0DT
- TLSH
  T1983382289B1AC30FC71F86B8F054A6661832D6AE3AA1F3B6424DF25C7D1375C26C457E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  Extras/AutoItX/AutoItX3.dll
- Size 709KB
- SHA256 a26fddee7674f74730d28d553220566bac64c4f877c5f33b5be6899202307845
- MD5 5bacfb9950a2e5cc6406f3ed03b3aa1d
- SHA1 16eb30debf314c9f342a183b37442cc349f3e648
- SHA512 b927545809635e9d0b6929b77a268269aa54c7b34b1f0fed0631d380f3eb155dd6d010d569183b39efac58b0f13404f02de9d953b470a4e6ed833f600248c0cc
- SSDEEP 12288:KoezZ/2/xE/TfXA0F1ll7I4zXXRpR4uBkrdyWRLtdtacs:wVWxyTfXAGRCrsOFac
- TLSH
  T124F47B0277818076FFA7A0330665E2778BFD6924146389AF13982D7AFD702B1673D663
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  Extras/AutoItX/AutoItX3_x64.dll
- Size 899KB
- SHA256 a9af515ba2eaae9ffc9ef81748d2553f2f85d3dabb1cb0a8887180214c05433a
- MD5 c6648beeefcb6a410ddbe8c7b4b8eb82
- SHA1 cb0f3cc0e38b04e69f4f2c972c49771717954565
- SHA512 884ac2a1dd769ce2d58e362dc71f1e27e837aa281ca3c44b15deda2500a1372694519bcf139545494208a27fec9de09e9dbeee99228fffe72e235c58b5fb3951
- SSDEEP 24576:ab1z0yRV0GZzcgyxUbCPnImH52jW5aoMab:ab1o+V0GuHMjWkFa
- TLSH
  T1BB156B0633A442B5FE67E13BCA438645EAF5B84A4623935F12A866B93F33330577E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

persistence privilege_escalation
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral10 behavioral9
- Target
  Extras/AutoUpdateIt/AutoSQLiteUpdateIt.au3
- Size 33KB
- SHA256 5f6af8ba881136a79ad2af069add1e37362017360a8f02bac96e16ba3becbecb
- MD5 dbad2259a11e9b9e7234220e668e0d4b
- SHA1 d2641f515ee2dc8093ec1d08a306c60eae8abc6f
- SHA512 60564b0e35b9afd6958ef996bc31f2c46e0d1036ad8f76e35e9e6065ab8ed5a41ab8b2cf5f3197b9ddc0584c946d9f215f28491613fa14e373366042c9ab4fba
- SSDEEP 768:qvDSrOGBhpJ3qzdPOt1xQxIJuTSMs8SeP/QH:qvDSCGBhpJ3qzdPOt1xQxIJuTSMOH
- TLSH
  T1BCE2DA1ABC2F4814B9016205E43EC905A79FC98FCABE335A68789C6E756173CC0B99D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Extras/Editors/Crimson/Manual Install and Notes.htm
- Size 2KB
- SHA256 8642a3a54c51dc82df24de81821ed3f18f2e1a69a32997df8232e40772aee0c5
- MD5 91ede7558338c6808dbab92c290eaa65
- SHA1 1c79e8b7e5175c3f248b65baf3374dbcddfaffc9
- SHA512 871551683c843283b9660b4c09fa8cc74a3b7b78e3284bfe7b92ff36e590f77ed86299ba7aa2e5318dd5428e8a2058f9887ff10b2a76397c53ce3d90ff7b0d31
- TLSH
  T1DF5161CA4B46EE9C51754A5B69DC7AC3888049DF332C4C3430BA980F140DE1572BB8F6
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  Extras/Editors/Crimson/autoit3.key
- Size 92KB
- SHA256 882b9d51995f2f40588c87e3d62288b469acaaeb7eb8ab86bac21ea995a5cc6d
- MD5 e4a33c5567d214b200e78dfb95ff9044
- SHA1 f79c9867db424a7305c42f967ad53f6135878d84
- SHA512 54f1fc0c1641b50f1183f91c7d6c3e741b99eaa73a993d38f89ec81e6a147b20ba5590c08edacb5ee2eefa27d7b8327a1c907e4e4e723e8fb028d15b38e48bf0
- SSDEEP 1536:0DLKFM3ec+f6paHK3TsZ+eQxbeKByMKahQbEDlsDtJSbZKbf3zv5sDevmvqc0F+:0nJjm1QtjBy72lYr75sDIEL
- TLSH
  T1F793EC95743072D3E3D72E0967D395097A832E1AD42BE5CE3173AC0CB9A78BE35D0986
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Extras/Editors/PSPad/AutoIt3.def
- Size 629KB
- SHA256 cb0535478b111b41b9cf230759e073a6bf9c4da6316be093fe19f1e5acc80bbb
- MD5 33b2e34c808dbcf72aabb17461cbdb25
- SHA1 dd3bcbd8bb5fc7aea6c8247623d8cc963b59064d
- SHA512 e7ca67692db33bc262adc920cb894180da4c55dc67ce698ef9706695bbdc0ef500f5e5bb4f24f16d5b0e6f3e011dcb322f4baaddd6a7a580f39be0696ff5c132
- SSDEEP 6144:G4x7Kh+6xHte2z2kQgRVYf68cx9Yxx6RPDOP1AZU0BMYLGyrneGBD2DOccw0jsIW:n68cx9Yxx6RPDOP1UMYLGyrn6FsW
- TLSH
  T182D4B817AE783135A15643C1B30ED2876369609D43BD929770ABA8E4E1B0C9D73FB6F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral16 behavioral17
- Target
  Extras/Editors/TextPad/Manual Install and Notes.htm
- Size 2KB
- SHA256 d1527a496eae3bfad2a6cc06d355ed61c93f3a9216ecda014aea431679b044cc
- MD5 b03e366b3c84a43aadf25613e1005bfd
- SHA1 c609a12f65faca9243d69fa720f1028e0effcaed
- SHA512 64c15d1199b316f264503074517c51b4c07f65b75c4a421fa74399bd2fcd054c9a8758b07361caf1f6c85ccc7ea5d6078372746388f9fcbde2e8821714d1f3be
- TLSH
  T18851831FC3534FA5422123E5902733961727CA6C73211BA1705FD237368EBB4792FAAA
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral18 behavioral19
- Target
  Extras/Editors/TextPad/autoit_v3.tcl
- Size 16KB
- SHA256 23317145dbfce9a42bc6f00949b35d3b5adf68dc35b6d4ccaa1efac8bf585e49
- MD5 135d17662823a0784341a5fbc77f1df7
- SHA1 1ab5bda219b0a6f5f61dbfc119c3e12f68f02e30
- SHA512 b449875cb42f8d40234527794c5bc119db2d3ca04187afa96fe1e0b3ecfca10d266a290b8c11adf6eab37e7fffac2f3e237b46155e02d350d9d2e67b6925b405
- SSDEEP 192:glxUHDCpE1ZsD+Qdp3eOcPR5hWnJduMV/dSTitCKkMQDgUwaQWo:gnUH/sn3ASwMV/dSTIVkwXWo
- TLSH
  T11572412BF276122F5381E2072795484961A4AE4965F217F6C2FC6D5DF38CCC9AB432D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral20 behavioral21
- Target
  Extras/Examples/COM/Scriptomatic.au3
- Size 20KB
- SHA256 22b1e3dbc9f6fa593a87765c186f4befd0d6041cdd8f3adefc828b952e08c49b
- MD5 a1b729edaa6b51a5972c426082c19737
- SHA1 d78d0dccfe195c7fefe6033aded4fdcd7823976e
- SHA512 fad8774e961763e3be2d5078d40979a4f959aa171515e5cda361818e782bc1a049c324a0a84829116b144d1d04ac5f9e22165baa0e63c732abfaba07f646fcf6
- SSDEEP 192:HdvhxMXrf8jwDl1p6PngSUF1qU41ukjLzNK7ZN8NrRRQiER/MOV+WQNuyPudF+rU:HHsD6gSUwukANN8NnOxFWPkI9E5L
- TLSH
  T1F49286D57C2BFD3D292BA1522933E8DCE90F4A0DD10AB65AF87CFD88518C42CC5A156E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22 behavioral23
- Target
  Extras/Examples/COM/Worksheet.xls
- Size 13KB
- SHA256 ad62ace472f8d341fe65ea4dd633d9f1ca3b04a82a66cf33a2d17794711ae241
- MD5 48ea6822ca50d0ed031947b9d8d329c1
- SHA1 f5548bcbd70ea31e567251317fdd2d34f001c160
- SHA512 62700cd2657d7a551e2cfee5c90fbd5dc65b837734119f6bbac5d4e0545ececb9ba8beacdf7427790845e0b02b3d4f1ea7ade8c11c6b4fda6ceb3213750a3f62
- SSDEEP 96:UqLyl2JLIqgchloB8MQj4dWb/ec/Oc/Oc/5CDch7+:Uqs2dhlFjl/D/D/56
- TLSH
  T1EF526C9AE6678941FA0A537047E3D716A3332D75CF670A81B70E732D4FBD6908903A62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  Extras/Examples/GUI/Advanced/msgboxwizard.au3
- Size 16KB
- SHA256 9cfc59c702259f4e35312f2d27416fb7fe5e21472dc4a88efdaf08d9a067a684
- MD5 de83becfe933ccce312c3e716636eebb
- SHA1 03642051e21ded64734df7340cae63151709585a
- SHA512 b77be9667ae48822cc3eb04253cc0de8047ba51db7b262644828fbc95256ba81913e460680f5a47336d947bcaa4a390cde8b17ed6752b754efc5a7539aeab8f5
- SSDEEP 192:9SXpXTn38NDXlJikGM5Iqr+7PS7B87zc70x7eI7vtAtbVRRx:9A389rriPmBUz00ReAFCbbP
- TLSH
  T1C3724449F69D9E65E311924258B99CCA8F2ECB3AD00831BBFC374E8C514079CE46579F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral26 behavioral27
- Target
  Extras/Examples/Helpfile/Call.au3
- Size 1KB
- SHA256 1362f064cf0ec94c177970ad93997e04b053697074e0cbf5c6b25cf8ee2c25f8
- MD5 c5d4ef31fd577946054db5d0ad666a31
- SHA1 861b3b1b758474097ce401231e1ecd4bc0319e65
- SHA512 98051eb6fa405cec292f70f61a1caca050c15b77cc7e8df77152897016be41d5aa290c304309f980fd30484093fba6ffaeb28f162aeafb6911cb24dae1fb96d6
- TLSH
  T1E3317444F25353AB9C0531E0087B5A88C330D859B2351D4AF0DD9AC215FA87E9AA3D8D
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral28 behavioral29
- Target
  Extras/Examples/Helpfile/Enum[2].au3
- Size 1KB
- SHA256 9bc05925dc6625096b709b754b45b4a8ca843d90f09c3661bf29b8eb0e0c81cb
- MD5 75f2cf899c08400ad91e9e56a7e7c538
- SHA1 a69b16c1e3ddb05d4e24ff32bb8ff52be5e61ef2
- SHA512 5676f6836dd89c554d214e2aaf791dfca91ec9f31176ff969f625000c89989a14946c1431a295ebc2398d16df09bf1386bd654cf22ab8ec2c7022a64546be905
- TLSH
  T19831DB6BE2A783305A4E16C0011F14AFE358837C825E5107BCBE9A8B70934E41636BD8
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral30 behavioral31
- Target
  Extras/Examples/Helpfile/FileGetAttrib.au3
- Size 1KB
- SHA256 9a725037b4b5b261da41f8a0e6c7490afc602820d3822cc27dd814e2dfe6abc1
- MD5 cf1926518aaeb015fa4d1a568c866ad3
- SHA1 5eb6bc1265da2e70aad219b7a70fbb44a8e34a13
- SHA512 f243e72c1d00068ddfe64a3865bd4b65bf23f42b2eaed39e7816b3928195c959e78d2f2d271e257cd38fbde415ef9cf5770a9bc12dd926ceaacecaee8ce25946
- TLSH
  T119317A35B957A7336F021681CEAE11C4DA95511D83A334F2E89EDD87306C1B8C2F97E9
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32