Overview

overview

8

Static

static

5

Achievemen....0.zip

windows10-2004-x64

1

Achievemen....0.zip

windows11-ltsc_2024-x64

1

Achievemen...er.exe

windows10-2004-x64

7

watchdog/n...t.d.ts

windows10-2004-x64

6

watchdog/n...t.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...s.d.ts

windows10-2004-x64

6

watchdog/n...s.d.ts

windows11-ltsc_2024-x64

8

watchdog/n...m.d.ts

windows10-2004-x64

6

watchdog/n...m.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...r.d.ts

windows10-2004-x64

6

watchdog/n...r.d.ts

windows11-ltsc_2024-x64

8

watchdog/n...r.d.ts

windows10-2004-x64

6

watchdog/n...r.d.ts

windows11-ltsc_2024-x64

8

watchdog/n...t.d.ts

windows10-2004-x64

6

watchdog/n...t.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...s.d.ts

windows10-2004-x64

6

watchdog/n...s.d.ts

windows11-ltsc_2024-x64

8

watchdog/n...e.d.ts

windows10-2004-x64

6

watchdog/n...e.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...x.d.ts

windows10-2004-x64

6

watchdog/n...x.d.ts

windows11-ltsc_2024-x64

8

watchdog/n...p.d.ts

windows10-2004-x64

6

watchdog/n...p.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...h.d.ts

windows10-2004-x64

6

watchdog/n...h.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...e.json

windows10-2004-x64

3

watchdog/n...e.json

windows11-ltsc_2024-x64

3

watchdog/n...r.d.ts

windows10-2004-x64

6

watchdog/n...r.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...x.d.ts

windows10-2004-x64

6

watchdog/n...x.d.ts

windows11-ltsc_2024-x64

1

watchdog/n...n.d.ts

windows10-2004-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Achievement.Watcher.Portable.3.11.0.zip
  • Size 165.4MB
  • Sample261003-ymmm5swfjg
  • SHA256 456c71d170f91346219fc2621211c88c9c084e184bb148f68f843d6fe350c331
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionjavascriptpersistenceransomwarespywarestealersvg

Malware Config

Targets

    • Target
      Achievement.Watcher.Portable.3.11.0.zip
    • Size 165.4MB
    • SHA256 456c71d170f91346219fc2621211c88c9c084e184bb148f68f843d6fe350c331
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      Achievement Watcher.exe
    • Size 234.4MB
    • SHA256 09dd1b68354f487eab8de65bd249949d448f31aab84ab4985e275db6b06cf568
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryexecutionpersistencespywarestealer

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Contacts third-party web service commonly abused for C2

      Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery
    behavioral3
    • Target
      watchdog/node_modules/@xan105/error/types/attempt.d.ts
    • Size 185B
    • SHA256 4a7996ecaa52dfeeff4c000cca152fe86b58c876283364086a8847eec0831e04
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral4behavioral5
    • Target
      watchdog/node_modules/@xan105/error/types/codes.d.ts
    • Size 150KB
    • SHA256 476cf31939c3c0d7681aeced0c89557c3853b4954ef074c24f7f4e40fda80d4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral6behavioral7
    • Target
      watchdog/node_modules/@xan105/error/types/codes/custom.d.ts
    • Size 85B
    • SHA256 199df97cb0ec8d0de96fc73368807701f2306cc858d2341958b2734b556de9c8
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral8behavioral9
    • Target
      watchdog/node_modules/@xan105/error/types/codes/linux/error.d.ts
    • Size 2KB
    • SHA256 ab0887151ff4346cbe0d0e38bc5d22b59de1645ba53f658d59d33ee4b30c04b7
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral11
    • Target
      watchdog/node_modules/@xan105/error/types/codes/windows/error.d.ts
    • Size 49KB
    • SHA256 2baa47d7860e08a69de4e6206c33445f337afb6873cc8fe2aae177721113ed8a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral12behavioral13
    • Target
      watchdog/node_modules/@xan105/error/types/codes/windows/hresult.d.ts
    • Size 78KB
    • SHA256 2f4a494f24a5357c2687c574d799b37a97bde268b302c585474d04d970d1310d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral14behavioral15
    • Target
      watchdog/node_modules/@xan105/error/types/codes/windows/ntstatus.d.ts
    • Size 45KB
    • SHA256 384c4a6731a84a31f6246accc9ff6b94d24592bb3d76e51335b141e80f61977d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral16behavioral17
    • Target
      watchdog/node_modules/@xan105/error/types/failure.d.ts
    • Size 375B
    • SHA256 141f8443ed27f33442c3a6daa2784c39b8d1880c1730a0a20ba8c0d0c16f8c16
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral18behavioral19
    • Target
      watchdog/node_modules/@xan105/error/types/index.d.ts
    • Size 145B
    • SHA256 37fa5bc75c097cdd12fe784b89c0f7b790da09dbce821c03581934d9773ed3c4
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral20behavioral21
    • Target
      watchdog/node_modules/@xan105/error/types/lookup.d.ts
    • Size 78B
    • SHA256 075bb162cc7a6cd170afd6bbe7a47a1d72ed439343549a82970d9c2d6ca4da8e
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral22behavioral23
    • Target
      watchdog/node_modules/@xan105/error/types/match.d.ts
    • Size 137B
    • SHA256 ee0a68be9253a40073f0c99ae1c1468d1d56015b1034e558e3b0ff7dd7f1d53d
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral24behavioral25
    • Target
      watchdog/node_modules/@xan105/ffi/package.json
    • Size 2KB
    • SHA256 06c4409080aaea8f6c3e77cfce3ebfd7845af4bbab86cf97616fdfcee5abb9bf
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral26behavioral27
    • Target
      watchdog/node_modules/@xan105/ffi/types/ffi-napi/helper.d.ts
    • Size 971B
    • SHA256 91a0d7be13dd3be116a9ebb7ff1bce0759a8bf06766c6c1d117359a21f777b0d
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral28behavioral29
    • Target
      watchdog/node_modules/@xan105/ffi/types/ffi-napi/index.d.ts
    • Size 84B
    • SHA256 9ae7f4b580a860523d49b86e6561fbb068d9b55794a2d9878dfe2bc40482bd85
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral30behavioral31
    • Target
      watchdog/node_modules/@xan105/ffi/types/ffi-napi/open.d.ts
    • Size 640B
    • SHA256 00299a3c01f12072ebf2b97745628505c66139d49eb07d1d054e9535a7f06496
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

3
T1059

PowerShell

1
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

System Network Connections Discovery

1
T1049

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks

static1

svgjavascript
Score
5/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

discoveryexecutionpersistencespywarestealer
Score
7/10

behavioral4

discovery
Score
6/10

behavioral5

Score
1/10

behavioral6

discovery
Score
6/10

behavioral7

adwarepersistenceransomwarespyware
Score
8/10

behavioral8

discovery
Score
6/10

behavioral9

Score
1/10

behavioral10

discovery
Score
6/10

behavioral11

adwarepersistenceransomwarespyware
Score
8/10

behavioral12

discovery
Score
6/10

behavioral13

adwarepersistenceransomwarespyware
Score
8/10

behavioral14

discovery
Score
6/10

behavioral15

Score
1/10

behavioral16

discovery
Score
6/10

behavioral17

adwarepersistenceransomwarespyware
Score
8/10

behavioral18

discovery
Score
6/10

behavioral19

Score
1/10

behavioral20

discovery
Score
6/10

behavioral21

adwarepersistenceransomwarespyware
Score
8/10

behavioral22

discovery
Score
6/10

behavioral23

Score
1/10

behavioral24

discovery
Score
6/10

behavioral25

Score
1/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
3/10

behavioral28

discovery
Score
6/10

behavioral29

Score
1/10

behavioral30

discovery
Score
6/10

behavioral31

Score
1/10

behavioral32

discovery
Score
6/10