51b1fd28ee7dda82860e70842dd444cb3872be8c81a3890c3045111de610c7ee

Sharing

Copy URL Twitter E-mail

General

Target
Sony Vegas Pro 13.7z
Size 514.0MB
Sample261007-qfp6pazv3r
SHA256 51b1fd28ee7dda82860e70842dd444cb3872be8c81a3890c3045111de610c7ee
MD5 f362d7a71cfd23df6e2462f2978cf33d
SHA1 b049fe9029e80dba37b3442d131607f8152b4080
SHA512 7baaf00d44e452e92f7fe5ad31a7ccab0d10b49830b0824ce0fe89a6cb0f5f775d68a0896366aa0e67cc2abc955b9504fb52f2b77fc33425a2058bcb1366c7f5
SSDEEP 12582912:wfvZJZcWc7JepasGg38RZPmP06hLJna3y4ce4h+GJ:wXZJZcx7JNg38RZLM4iZcs
TLSH
T16749336AA41CAE3C86BD32FEA789721D7008219442355E7EF306EFE9350B3D75637621
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Sony Vegas Pro 13.0 Build 373 x64/Portable/Sony_Vegas_13.exe
- Size 59.9MB
- SHA256 da1dfde2d7333ab85badb024d9112b9d80c69533f6f6b0a7dbe997dd472a5fd5
- MD5 4b3ad4b4ac6c5591facc56f02a9feb7a
- SHA1 e07adb9b155e9d16245b773ab20aac8dafe10bee
- SHA512 47b6491539378976ae7230feee2914ebd0b60d3b6d049fd2c369c2e36a9f3b85d2ea7e17f1040889cd32ac604d96495b0e4fc204f1dc99d803a49cfa9c5c2fe8
- SSDEEP 1572864:xWmvoqwrZY/htCoFSWRpr/TLKZO7roGwwO:dvoPrZcvou7GZApjO
- TLSH
  T1BED733243A760571E17E46F0E6B2B4B717ED9A89AF2835A6D05273A13E3E0D9147FF00
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Writes a Windows system DLL name to a user directory
  A module named after a system DLL outside System32 can be loaded instead of the real one by a program searching that directory.
  defense_evasion
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  Sony Vegas Pro 13.0 Build 373 x64/RePack/Sony.Vegas.Pro.v13.0.373.exe
- Size 71.8MB
- SHA256 c2c375f3c45fc7e08bbe792f687b787b518799ad55cd2b39c30ad1176e9f6059
- MD5 84bb439d60931038999c983d8fd03713
- SHA1 5bd259c31bb8577b9ef129cf02be25b386ab434a
- SHA512 6c9893a6c4173e15c363428ca0320d9914f0ad33009938a3fab311f248ec519cba6f7788f0fd93863cfc262829580c8025fa454ef4f5c6495b69c6d642159179
- SSDEEP 1572864:Is0hI84RV7DC24uESPrH6GUfRY4OrYDuytUk19+KgQ7ESrpt:L0hCRY2zDH61RRSytUk19+Klppt
- TLSH
  T1EBF7332AFDECE164CA762CBF7534FB94E789887142546DB38395304BA517AB30BCA710
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  $PLUGINSDIR/Aero.dll
- Size 6KB
- SHA256 b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c
- MD5 869c5949a10b32d3a31966cc5291301b
- SHA1 329080c974d593ecdefd02afa38dd663a10331c4
- SHA512 3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca
- SSDEEP 96:AdxrhBuDBzndge+Kwv7KzxsJBuEGQKq+5okMU+S0767ZJG:IGB+Bh78xsPLGQKqEokSS0e7ZJ
- TLSH
  T19EC12A4577F8113EE0AAC73295AB062B7178BC40C7FB5AED0C0E145B38312908D89B63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery upx adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- ACProtect 1.3x - 1.4x DLL software
  Detects file using ACProtect software.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral5 behavioral6
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sffrgpnv_x64_esp.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sffrgpnv_x64_fra.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sffrgpnv_x64_jpn.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack1_x64.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack1_x64_deu.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack1_x64_esp.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack1_x64_fra.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack1_x64_jpn.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack2_x64.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack2_x64_deu.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral25 behavioral26
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack2_x64_esp.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral27 behavioral28
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack2_x64_fra.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  Program Files/Sony/Shared Plug-Ins/Help Files/sfppack2_x64_jpn.chm
- Size 11KB
- SHA256 b3fa12b21aa606ad6b8fe57141a081c675acf9ff078349859eb7eaf20cea7792
- MD5 174a41bafb43045e170b4419c3f518cb
- SHA1 69150c318384d2109b286f5c195abee5212a7830
- SHA512 e3f1db1bcd21c2aadf0fc805ab63223a296e77d076b72d32764f154c15cd67744b5194be096d8701199ea0b12ccf8edd1e72b358cc93538297227a8c4a560acb
- SSDEEP 96:wXtQvML9Udc8r6RayK9q0FOG2k4EThlAKrzBS/f:6gs9UdcbRB0nNhl5rzBS/f
- TLSH
  T17B427CB43221C419C04BA6B2CFD74A383D667D57BADE5095224DF63D2AF0F094BB8063
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Defense Evasion

Hijack Execution Flow

T1574

DLL Search Order Hijacking

T1574.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Writes a Windows system DLL name to a user directory

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

ACProtect 1.3x - 1.4x DLL software

Loads dropped DLL

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

ACProtect 1.3x - 1.4x DLL software

Enumerates connected drives

UPX packed file

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32