77d60b00a409eb3afb13771fe4b1c7548709bd2597bd038b145d001d269bda2a

Sharing

Copy URL Twitter E-mail

General

Target
WindowMeThis-1.0.4-windows-x64.zip
Size 13.7MB
Sample261012-snfckadh92
SHA256 77d60b00a409eb3afb13771fe4b1c7548709bd2597bd038b145d001d269bda2a
MD5 c5dc6a06157adc6dd778c107eb3eedda
SHA1 6c74db173ccfb7202c0ff5bb0b76e4381bca17c4
SHA512 b0f3e5716c56de188f6f93e4526cc62abc3902c4e6873aa5abc50f1ec46b35f152de5a20c3e4269df055038f455de475182d00d400310e2dd742c4cf77d98751
SSDEEP 393216:/oTRcmVARLhbQTQEFcFopqEwetdXNWNNhkQFF:/cRcmVALhwQEmFqqEpPNWNPkg
TLSH
T14AE633E2AADE4454D83DD53121A21F47802C78F109C6DB5B7AF03987ECA7086EB4B7D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Targets

- Target
  WindowMeThis/WindowMeThis.exe
- Size 2.9MB
- SHA256 130760c765711453947d4d7c5e4f72329e9224d0ee59fa6be0189d7c84c41126
- MD5 e2bbe933f0f0469c479a1fe2f0186651
- SHA1 7404c1c9c5c1149103df7cb9fdd672dbedaa0517
- SHA512 4188865944c5250c4f879370a4c69250b21cbda4c79c701825c3506b29292581d3d1b6a28d8fa3ac43d3afe06f3780e0cf782432ec5f847eb826d4ba2c5dcdf3
- SSDEEP 49152:nP5Kg2mEOEdk2g0gfSqvCy9mCa9EqLAygC6S0WXuvD/6ELxvsZp6D:CmEBgvCy/c0TC6S1i/6ELtsn6D
- TLSH
  T1CFE52359EBE114F9F8F3923DDAA3C406CA7278610774D9DF4390463A3E236D6183A7A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  WindowMeThis/_internal/VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH
  T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  WindowMeThis/_internal/VCRUNTIME140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH
  T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  WindowMeThis/_internal/_bz2.pyd
- Size 84KB
- SHA256 6da4d453852346299e983b458f3ec2f0db3b5f765998ba3f45c91b4a1549037b
- MD5 739979534c8ca60e46bddabe2a404839
- SHA1 25db2a8e280583dce5c6706f6c46ce52215ae134
- SHA512 773bfeb481999b0831a7762245a83a7d8ae699db15ea59bee74dad2b816b1cf2f507661533236f5d146d215d02c27a99b8d2aa7f34fb21b5b25c378aa68df431
- SSDEEP 1536:gjDODcz7qBq5IBcOrwTzZP3TmOemIMjTh8vtfsjRKJIPLVJyb2QS9bfIbHtvGl:gHODcz2B8O0pqOrjTuvtkjIJIPLVsHT6
- TLSH
  T1C2837E52A76472F6F9AF41B596C10353F731BB960710A3AFB244C3853F12B81AF68365
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  WindowMeThis/_internal/_ctypes.pyd
- Size 131KB
- SHA256 5bcddf4c374c4d247e1e4a61f3347159c36c5785fe43bdae11a4e6c9ea2c0166
- MD5 870522a9092d72a5d09e9957f6e0d300
- SHA1 0667714a5ac524fd7af152e9461c16778338767d
- SHA512 6db5b6911ca7d86ba0d792877ca18608267764eefa43d910642392c44fe39f85e3c5df51bbe8cd3dab902d9c5762d8c05bb8a94af8c78428d74c7f1de2149cba
- SSDEEP 3072:gP6/CZiQyJDSDNbLy/Af/Fh+4JxfSP1IPyPlfv:q5iQTNXFf/Fh+ixM5
- TLSH
  T1D1D37D0B776800AADA678174C133AF47EBF1B493161057CF02A4C69A2F637A36E7E715
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  WindowMeThis/_internal/_decimal.pyd
- Size 280KB
- SHA256 eeb278dfbdb305bb5af916ed79e878943e25dc4bd6e99ec17abb7b3fd9f935d5
- MD5 cbb1f4286eb2d60e6b7b15ff2a62f213
- SHA1 f70cc904c38006870231d0508f76728cf5f81be7
- SHA512 fc4c47cc826d2c89ba4f6bfe16c6eb92f0f64905c0a789fddcbb3e4128f7bd718b9e765127c6caac6c2e6d2e554b71f3c41ab674058057854e5441fecd377ca7
- SSDEEP 6144:NHpjMieUEta07dm09JGZGqqM33fIWeA5Is1Mxhg:xtveUEb00qFss+xhg
- TLSH
  T192547C57A3490CA8EE7380748A4B9B57F7B278960360C78F43A48A973F93793276D744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  WindowMeThis/_internal/_hashlib.pyd
- Size 67KB
- SHA256 4d3eb9d9492d626c7bb10cfe5ab233a9195ec7b27e92b465b287e7a24fc8266c
- MD5 eb43233cfd093c2bc83767d22e804802
- SHA1 12d12d61030f4c0d9f69f2e0322456f0d60a9221
- SHA512 6556d1a735ee9662c3374bf40d95b62602a47e732db3898f63d1075cb9f1abb48d5e5cd6681e6ae0d3530cdc100f33b3651510e2f791fb00cad340837bee408c
- SSDEEP 1536:Qp9Md+mkgVvQ33K4WH1YSf9u8hIPvIo4yb2QS9GfILO8:eMQ+VIGH+Sf9u8hIPvIofGf
- TLSH
  T112638C85979840A2E9238276C8A34F83FE74F2522711DBDF62A8C18D2F133C39776765
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  WindowMeThis/_internal/_lzma.pyd
- Size 155KB
- SHA256 2b4dcb12c0420ffced4b91968ae4eff6cb585f0f07490160c6da47da63064a99
- MD5 7cf9dd2e4839ff0c7c2d6a467de38a46
- SHA1 de6c6b88100e5201a4b095293258a381a4e9fdf8
- SHA512 541d10e5ed2783d86b2ee19be7d30801ec34f04a6d92589a630ebb7ac66172a64c19b51e29f065db986c3ddff38dea4115c99f892c0a21511dd27df93cc05608
- SSDEEP 3072:RK1fxTOfpRnifp5/eNRFGznf59mNo5/ujJIP01MGUT:R6JTOjKsHYhYOgj0z
- TLSH
  T1AEF35B86A794F0E5F3628C38D2624F57E6F5785A0320929A01CC936D2B1FB759E2E313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  WindowMeThis/_internal/_queue.pyd
- Size 34KB
- SHA256 79c196a0804b152fc48b4055387f4352838e41c28863a0c946e7a98137e681e1
- MD5 78b92e2645447dc759678a9be94a7b61
- SHA1 44c94b113d61341b150b6f2a6a67a9a652b5057f
- SHA512 4af14f7dbc5998853bc0d1ad71a7f45c994dcaf8ff083c1a0a7c745eecd5acaa478c8724dda75da33ce107321a883c31b3a03fe194c6dcb19a847185c0232460
- SSDEEP 768:72Z6ytZI881IP9UL1yb2Zegc2Ip4ApPpTxf1mlRaXQ6BB:SnZI881IP9Upyb2QS9aPbfIYQ2B
- TLSH
  T12CF27DC69A6C5047E663C670C1F7EE82F935F7D3560187AF20A9C28E1E133C2A726359
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  WindowMeThis/_internal/_ssl.pyd
- Size 186KB
- SHA256 30ff82a3ea0c675ddc99e6b14f71ca750f06e77d6653e2da3d7d35b7ef0fc2ed
- MD5 b732b9ea24beed95e1cdd46781c4f10a
- SHA1 bf85d5ccec9e71edf2844fda9a470254c19a6db7
- SHA512 7914bd9befc187130eb556994e7f4bbe62f5b2a4e0dd68e25386980d6106ff5335432bff08b72aec4ec157e5171b54386acd6d6bf360a8d68495b18443b8f1ae
- SSDEEP 3072:5N5wSvWfbkqZkNY+NZYf2hX7pJbMNdK1OsmY+pdCN/TEN9MAfXuG8MQNMMLoH9eN:v2RfbVJ+X02hX7pJwPWRMMMQN
- TLSH
  T17A146B47B6446AF7D802E4F9C2334502FBB0F155331257DE44D6EAA50F0374AAEAAB63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  WindowMeThis/_internal/_tcl_data/auto.tcl
- Size 21KB
- SHA256 08113823951619d659eb03a1f6acd2f9500e1264795219125a5df7b83cabcb99
- MD5 97efa9ebe840ea051f9706504c8bd783
- SHA1 287dea14d47977dcd8edc525fe750c836264db5c
- SHA512 ab9fc210f3bfd181cc2b93dd348415f67f763b2c7961179a88eba3f7f87e44b21a66ea4ea53715fb88784288c75b8270640f3bc6beafb0e8cc21966068a79bf2
- SSDEEP 384:UqT9XC9VZvWQjCTzsCTV7672ORgS0myvxFRTX7Xvt3wBTnbXhCUquyvz:LT9XC9VZvhjCPsCp7JlmyvTxvt3gTnbW
- TLSH
  T1EFA2B7635F9542A630B1C22B553DB9A4EF2F81B70675801D38F8912C37F1815C6BEAEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  WindowMeThis/_internal/_tcl_data/clock.tcl
- Size 129KB
- SHA256 bd1c2dc481a582ef9eab301468ec7e7c3a284c57617fb2f4a8a97c22576fc762
- MD5 31bb1cacf5d128f77c0922800d3e111a
- SHA1 93262bdfa958cd64906fb8c24db59294730c5747
- SHA512 a156698c7dd9ae3dfcd2512e59a0a382027a23b52330191464f00d6efa96a22bead2d7c470f0f44b07a2dbc209a2451eb92ca91355ece75f0e23084b9e2848ca
- SSDEEP 3072:Ybn4IdhYvuCS9epsF4AzqpSMpWzP7ejMiIAEBsq6UkPAPaZqHYM8EN4LhVLAMrXl:Ybn4IB9epsF4SqpSMpWzP7ejM/NBsq6P
- TLSH
  T1AAD3A6027F19412E71B2D3364ABAE198DF2ED1B776AB805CBCAE405C3B1091446BFBD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral23 behavioral24
- Target
  WindowMeThis/_internal/_tcl_data/http1.0/http.tcl
- Size 9KB
- SHA256 fa7b657aa7d5bbd1bf1e3fbba8bb26fddd6ccff5805625d2e400db5ebe1f968a
- MD5 bef74a91e2e8f1252f594781427a0122
- SHA1 d5e6730f3e65e3b07482f1af9ee13605566adcb7
- SHA512 ffcc7316ae0b7758c4d01a4bcf9c8007ca4e1b5555955862c72520507e55d80da251706310be9db85ed75a6f319879b8ce20bc4b9c9433d0d7c97fda8c80e585
- SSDEEP 192:kipkqA3KsBMAikGJ4kIWPa95KTBoF7dg/8YNkgQ4id:TkqWKsB8kGJ4kIWPaDFzTd
- TLSH
  T1CD226485620691AD6DB2433ACEB990B0EE3A51B321B9416CBC5DC1643F7250E9FFCBD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  WindowMeThis/_internal/_tcl_data/init.tcl
- Size 25KB
- SHA256 acacce15658dd7ce8f69b1e3d3a94770a22972a8e906eb3b61cd06f0ecd5db59
- MD5 ffe4e47b5f4f96ec33fb31d52ef0b636
- SHA1 3a625e493f8778277f65ffef1e0879fbec0e4d0d
- SHA512 dbbfd92ab6d95672f7882f3affb75f31749281c7450c29fcef58b5bdfd4f42b6d1d9f3a50ae0d3aa27e95d48918ed55cde5149751f892538bdd2dc39c618927e
- SSDEEP 768:+XrgPHudKlE7BG6Xg3tMo846ofRRECL9QDjr5v7hzx/i:igGdKlK4Ao846offLmNhNi
- TLSH
  T104C2A8112388917932B3533686B5E598EE7EC1F706A941BCBCCC825C777150A4AFDBD2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral27 behavioral28
- Target
  WindowMeThis/_internal/_tcl_data/opt0.4/optparse.tcl
- Size 32KB
- SHA256 b8ac6c849dd7ee771f9d95718c3b9fc289872f05bfb1a36d32fde8edcba5e1c4
- MD5 403ee782437d9e848593a8c9a143863f
- SHA1 8994c3fe6cccf42a72f1b08e95f89621ef6163ab
- SHA512 feb740cca1a5243347beeb86b6f29582f85b4649050c8a2a65997aca75e2d7dd70f53568ecbb5a25a9947239b3ae690de615ffffa8e44c6b9020f2e0bae457d1
- SSDEEP 768:4DXxAptehhnN+ZgG6sRclBAdtsoLKiF64aJQ2L:kOSh14pCBAdqva5aJvL
- TLSH
  T192E28226BA45629D26B252368E798451FF3EC2735296407CFC9C817C3FB0942C6BEBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral29 behavioral30
- Target
  WindowMeThis/_internal/_tcl_data/package.tcl
- Size 23KB
- SHA256 b471cec9056b62d562020b14d69d4bd1f92dfe158afc8ba81c6341836211ca46
- MD5 6a7b6485d3b290fc5d412ed1d62a170d
- SHA1 50475e80e3969de279edfb1bf8d9c19694c36c0b
- SHA512 36ced797ec18d4aa68fcce57f6eb510e78508d14646cf43ea2effb6f2cf88529d0cb5a4a136fb1252edbb95cba646bdcd19a8cd90a86b19fc28bb9611e2ccb73
- SSDEEP 384:8xgrmNIpEHsDAW2UfnImRqXqQx6XmchmCWhzPLrXJjJh6PLfzd7lG:8xgrmNIwsDnvIm86QGRhLWhzDzJ9h6DS
- TLSH
  T14BB2C821B389915A34B153639B352D8CCF3EC0FF51A951BC78D482BC776092A0ADE7E6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32