c6b550402455b855df58c0ae63ef52def7ea58a06daf07eecb8120ae4dfa0bec

Sharing

Copy URL Twitter E-mail

General

Target
Tds.exe
Size 115.1MB
Sample261017-b9rt2sgw2w
SHA256 c6b550402455b855df58c0ae63ef52def7ea58a06daf07eecb8120ae4dfa0bec
MD5 0a12242694ec1279e5ed730ecc80f116
SHA1 fa94c2a06803f8e6eb3f2ccf793886d0abbcea04
SHA512 1b0b6a2cb0c2af4841b9e9ec79e068c55d22cb0b2f0a3e2383191b5cdd67a5a56d49e49079334c2e00075e4e89c617a92ba80bde73da9f0bc741101017208aa6
SSDEEP 3145728:eZkM0CEk4IkL1C+8C3pFpaVRPIXywZU0lI8ONoPX:41ok4IilfpsezG8uov
TLSH
T1564833ECC9EA6CFDF3C9A3BB56758DDC10889E3312A5056FAD5729C1090930D8ED486E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Credentials

Protocol
ftp
Host
upd2.winmansoftware.com
Port
21
Username
anonymous

Targets

- Target
  Tds.exe
- Size 115.1MB
- SHA256 c6b550402455b855df58c0ae63ef52def7ea58a06daf07eecb8120ae4dfa0bec
- MD5 0a12242694ec1279e5ed730ecc80f116
- SHA1 fa94c2a06803f8e6eb3f2ccf793886d0abbcea04
- SHA512 1b0b6a2cb0c2af4841b9e9ec79e068c55d22cb0b2f0a3e2383191b5cdd67a5a56d49e49079334c2e00075e4e89c617a92ba80bde73da9f0bc741101017208aa6
- SSDEEP 3145728:eZkM0CEk4IkL1C+8C3pFpaVRPIXywZU0lI8ONoPX:41ok4IilfpsezG8uov
- TLSH
  T1564833ECC9EA6CFDF3C9A3BB56758DDC10889E3312A5056FAD5729C1090930D8ED486E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery installer link macro macro_on_action pdf spyware trojan
- Office macro that triggers on suspicious action
  Office document macro which triggers in special circumstances - often malicious.
  macro macro_on_action
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Feat_Temp/$_28_
- Size 1.3MB
- SHA256 4a10731cc156a33472809bfc927fbe9d3872ca26d2aa3ea5ccbfdac896b4ea37
- MD5 00d2fb894f1e69afd6021eeb628b36ae
- SHA1 89fb1d6460385fed1fa8fe85dfdb5a3dd77d262a
- SHA512 518a2d5d935ffc34b0c99180820c7db82ccf3b4e12cf7f13650a3e708938fa1ecc38074b8775eab9a00dee736272cb25d1716f2dbc5465f3980035a947f12354
- SSDEEP 24576:5YJV13CMj7PADAbG0YL3EKTaLg6/Q7GA4FzCROqVhxMySrnBVr+rvAWIJTrp5/CO:GFCY7PWAbG00JTad4CtFvq3mlNVr+roN
- TLSH
  T1CF553342566554A3FED25A7299BBC6720FF1FF460981EEFF530A7A24B400B45EB4830E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral11 behavioral12
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 c7fef6457989d97fecc0616a69947927da9d8c493f7905dc8475c748f044f3cf
- MD5 ece25721125d55aa26cdfe019c871476
- SHA1 b87685ae482553823bf95e73e790de48dc0c11ba
- SHA512 4e384735d03c943f5eb3396bb3a9cb42c9d8a5479fe2871de5b8bc18db4bbd6e2c5f8fd71b6840512a7249e12a1c63e0e760417e4baa3dc30f51375588410480
- SSDEEP 384:EXsC43tPegZ3eBaRwCPOYY7nNYXC06/Yosa:EXJTgZ3eBTCmrnNA5p
- TLSH
  T1E1624D1137C558B3E2D62A797EE3B7138FA5F722A4438E0BC7332E06281A5956E7C311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
- MD5 cff85c549d536f651d4fb8387f1976f2
- SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
- SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
- SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
- TLSH
  T126426B129BB089F2F591583814667F2A6FBE9C5D27F50563CFE304D63D212CB983A283
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  $PLUGINSDIR/ioSpecial.ini
- Size 211B
- SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
- MD5 e2d5070bc28db1ac745613689ff86067
- SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
- SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
- TLSH
  T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
- MD5 cbe40fd2b1ec96daedc65da172d90022
- SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
- SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
- SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
- TLSH
  T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  $_2_
- Size 721KB
- SHA256 df47dca0e843e1bbdbb80dae60afb6dfb4bf5f4c2a709d8b3e543fcf3fb84033
- MD5 0965bb57d912c491b6975b76c71e7eb5
- SHA1 987155d0238096aae1cd3d862f0764fc21ab9919
- SHA512 898071349ed7a96d517c523f789c2fd4bc9177056ffa67bc0e2c21cf96191cb89c5d3e02653ce19cf9ddd4710dfc1df2b5edef29753e2af2210e4c7d088e9d5b
- SSDEEP 12288:kQs8IsCeq/p5qrk1XnVId8O5kszZ1ciqJW+stCZc4DPZ/McCPiATyVA7/:kZzsCeq/p5qrSLO5bdEW+skNDx/OPlTV
- TLSH
  T1EDF4C727F7A52109F0638970A9B562669C3ABC322D18AC5FB3415E4E7431AC79EF431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $_3_
- Size 721KB
- SHA256 df47dca0e843e1bbdbb80dae60afb6dfb4bf5f4c2a709d8b3e543fcf3fb84033
- MD5 0965bb57d912c491b6975b76c71e7eb5
- SHA1 987155d0238096aae1cd3d862f0764fc21ab9919
- SHA512 898071349ed7a96d517c523f789c2fd4bc9177056ffa67bc0e2c21cf96191cb89c5d3e02653ce19cf9ddd4710dfc1df2b5edef29753e2af2210e4c7d088e9d5b
- SSDEEP 12288:kQs8IsCeq/p5qrk1XnVId8O5kszZ1ciqJW+stCZc4DPZ/McCPiATyVA7/:kZzsCeq/p5qrSLO5bdEW+skNDx/OPlTV
- TLSH
  T1EDF4C727F7A52109F0638970A9B562669C3ABC322D18AC5FB3415E4E7431AC79EF431F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23 behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Office macro that triggers on suspicious action

Enumerates connected drives

Network Service Discovery

Checks computer location settings

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24