2da52685403f4bd6bf903d3683f1d3f300cfb72c252611e993e66f9e83686212

Sharing

Copy URL Twitter E-mail

General

Target
UserSecurityManager.zip
Size 3.2MB
Sample261027-ec6tgs1vcs
SHA256 2da52685403f4bd6bf903d3683f1d3f300cfb72c252611e993e66f9e83686212
MD5 fc8709afa6d7249c119b9b463da58fed
SHA1 c785bd6bdcbe35e29e4cf4673db09e0ce44f7adf
SHA512 2fe50bfc415dad5dd66aa2dd29602e022e4f953b32d05f700dded6da70fcc701f4789305d49597c8c21434a2cb67f5ba06673aedd4b06f46117309a277e07913
SSDEEP 98304:IMfu8MVZUh8OGwIiwLCAxEFAAPXCFo3ebjJZ:nMPuyJLCnAAPXBubjJZ
TLSH
T123F533494B1F1753C90E73B3749E48C9EBC9890BE161B00A76FA4B2CD89B8D78760369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  UserSecurityManager/Install-IIS-Features.ps1
- Size 3KB
- SHA256 d950e1ef5830897a4f390f5af83980fab6956d1d3f05f6c67194e352a71b1527
- MD5 8cef458926d10720c04c60307eeaf4ea
- SHA1 6476b51c6a2ea1c19e2c32d2222716ae32f23d4c
- SHA512 6c85a5b355252e2120844256b76ed5644388b73c5500eee0c5274d8efc1e16ee0b4b76a5b2a590ff2cc18595b5e97f23e13f4c7ac44e48e4f53cbceb63b61fd2
- TLSH
  T15771046FC3565828FBB79C76A78782E36C1C59E305D41CEAD0904294F6C28BBB476C83
- MD5 SHA1 SHA512 TLSH
Score

7^/10

discovery execution persistence ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  UserSecurityManager/Readme.md
- Size 7KB
- SHA256 43b10e7b92ab70e2381e5b14abc4f2e65062b4452080b225ae9148e6f7455e40
- MD5 b74da500929c729fca1daeb34c522da8
- SHA1 2ff1eb85cfe6a1c03ae8d2b78b7019fd05c5f303
- SHA512 732783e40cb4c6e8f3cd196978abb5e10161b15b01b1c0830a5004ef10c77df4a443d38144f2c27e0684b90840fcc8e3bdbe5c5585660b7fcf160b88dcf0a975
- SSDEEP 96:/zMDQFov13eN9I/lASY6lGQb7fakpcBggKr8N0kwseT/VIfsVw4Xadn5eOx6q/wu:/oDQFE1Tl6aHakpch4WmXm51LamfF
- TLSH
  T134E17487424F1F7756870217A66641E8BBB6802DD663083835BCB97CF77CA88D3A24DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  UserSecurityManager/Usersecuritymanager - Start FoxPro IDE with Web Connection.lnk
- Size 1KB
- SHA256 5724207ecd751d32f1668b5f906e186340cbbf1c2acb9e7a4006a83a0d554b46
- MD5 19fa1a969bd268897f68dff31a8dabd6
- SHA1 5204fd3714091157a507d29602e92b08f3c55cd1
- SHA512 cc2a8578ae09c4eaef9a9570994567b6605f7b708123f5b058050841cbf4775c95c4374099cf1b1418748e88c26c4603cb5bd6e0d9e7b4f5521094ddd2ae4255
- TLSH
  T18F4198112FF94A0AF7B327BA647AE655DC37FC125B16CA8C8441014F4432E00AE6AB7B
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  UserSecurityManager/build.bat
- Size 1KB
- SHA256 5b3a41434393652ad3b6e8694aa5a2101afa41fdbe8fb96ded21e9285edd7a52
- MD5 f31bdd024b6283d401d29e76e6b5a50a
- SHA1 9b82baddeac3dbc77c47ccc9b150174bede23182
- SHA512 f32b0a26447e016b73d84721c5614de5549de5a13bd3802884b36514691e1ea14128af6253de14f35933972b28498d2d81fe27f4ec16d87c53de1320befb9dac
- TLSH
  T18B11ADDA77C7052514475B917B560E6BED7FD0A5E388080E30C724C0565EF28623A7AC
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  UserSecurityManager/deploy/Install-IIS-Features.ps1
- Size 3KB
- SHA256 4fd63b73b54ce62ff5148a5eddbd089a97ef10bef87fab8e36dfcb7c1c4deb18
- MD5 1d5aa8d437bec136146b4b79a439b0a7
- SHA1 58daef7c78a269e93d5cd8dd532128f7b081eec2
- SHA512 6572883b545bb1d794c1890df1673155e6255b53f59a8bf2feb37c8ddf4956271c7efba14cbe646a0c3b5e5193af69697f6ed67220d09179ced4109cf9d66f67
- TLSH
  T1AF61E36FC3565828FBB79C76A78782E36C1C59D309D41CEAD0944294F7828BBB476C83
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution discovery persistence ransomware
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral10 behavioral9
- Target
  UserSecurityManager/deploy/UsersecuritymanagerMain.prg
- Size 10KB
- SHA256 85572867f742fb7a67c745e623cb3060cc3e3484f9c6c0e0da666dd169ba62f3
- MD5 4e8e63bd17f508db3a58e5315b01b42c
- SHA1 eb905c11d9f4420e49ebdbf10ca272435c03be07
- SHA512 d86c5274ada660f31c9535f7369449f55e8b13dc8dd59f0609fd588e35980d4ec8ce7b8bb353dfdcc83d48c0d223afd8bcc472101210c199757d51a1749970ac
- SSDEEP 192:xJgZbVxBKqQux4Uc1Pt8EeHZVWkl8Kx2l3Zz++e3UKAJmZsWaJNnBM1:QVav5ZEHD8W2lbKAJmZi/B4
- TLSH
  T15D32504B468A1EAB527A0203A66756D8E7F10007276224BC34ACB97C7B7CFCD52722DD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12
- Target
  UserSecurityManager/deploy/Usersecuritymanager_ServerConfig.prg
- Size 4KB
- SHA256 cf0346a774f2af6899a9ad30da6957e103f1aae488c45704ba838cb5056efa18
- MD5 db9f30587f1596e5433930801deac37e
- SHA1 75aa946de2e7db4fa86689aa85c8e253a52c6d37
- SHA512 f278526ce038c2cc0b73a79469c1f7688f31aa1e8354d504562ad4f6312a79662957dcfb7a653fa7872c8fcc0bc9a2f33d6c52304b9369ca46517bc10e3d23c5
- SSDEEP 96:xFbyWUGo+JdIRHn+rdCDtoGQRR0jlhWRalqNRSRjk/sOB/tuQ/RsI1BpYprxRD:xFbyXV+0xidC7SCiVSRjkU4rRnbpYprz
- TLSH
  T138A1438B074E0D6D45A20A17267603D8C7E6812717A9817CBA3CF83D57FEF8E2712699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral13 behavioral14
- Target
  UserSecurityManager/deploy/build.prg
- Size 2KB
- SHA256 033f2e37ede7aa63108ef5d9580f079d59a781574237e4206f9aaf3542bcf094
- MD5 b0c6cf555ad222e6ca3765cb35360ba9
- SHA1 4871ab7021cb1204e44ffba60adc05cd82623b32
- SHA512 28fe7757651371db209675136b30053f4be3704bcfab76a8cb5cf8576a27a00f03b835041a7783a88f1ea4819e940f694b46fbd885499a541cf9edcfc91608ec
- TLSH
  T1CB51421D434F8C160436C755C1BB82D0EBC061070391489D386DFD79AFBEE4919657DD
- MD5 SHA1 SHA512 TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral15 behavioral16
- Target
  UserSecurityManager/deploy/temp/TEMP.HTM
- Size 7KB
- SHA256 453519540fdfc90fa1f86be22b207a028ef18766c99e70f52405dcdccaefa6b2
- MD5 db9e94bf5bdc07e1156a90bad52fc0dc
- SHA1 f82bca4d5c9099e07a985ef67170227c950cce2f
- SHA512 3c6ae9d01fe1adf5cf21a933f8ba08ade26569df1d63238e87cb4503a1884add78f7d4395bb98ec34ef15458a39f5788043196b312b03c72f944a4228427662f
- SSDEEP 192:lj/DovDk6DRNWIboRz7Lpv1PUb+ohsKDGDU:lAvDkMRNBbQVvOb+ohsKyDU
- TLSH
  T13AE18209730F5A2312B692936074D6DDB78EC932C3922814B2F427BBB7CBE85556215A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  UserSecurityManager/deploy/usersecuritymanagerprocess.prg
- Size 16KB
- SHA256 a7f3431b41e2b503f66b9c7ad997dfd8cd91712a401c8784bc3a87061dc013fc
- MD5 e8e1d4c6f343b7423d497e00dda2cc4e
- SHA1 2ed68389d9d4c2673c38d8ffeaea15268be248d3
- SHA512 df56f759dba09050b52cdb2f30fe3042583c3481d83471838e9305c3fc105258ee677d577cc14da8b56ae186aa92a04c0de33ca5782dae2309f65b3144fe8c2c
- SSDEEP 384:zyPDNc0gMYovugV1ggQz6ps2CNKwcdQ9IwMxqaQGefXpIoWX:+LRc2z0ydX
- TLSH
  T1F6726309278A1D32A561424AB03747D5F2D80003636644BC7D7CBEFAAB3CF89DD60AAD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral19 behavioral20
- Target
  UserSecurityManager/deploy/wcTraceLog.txt
- Size 12KB
- SHA256 b7dacf8f02ffcd74fc91c9060816e668f51f936f4df8f4d2572bf8da97e2ed94
- MD5 796d9b29da05b9bb0ae5acfb5cebe6df
- SHA1 11c11c04c507a4943b6257f5d1ddff6259266188
- SHA512 bd6a8225e35eaa6ab527cda120d6bb58697890c19086bd263d8068ac74be44f855152af70ec406a65409e77c894063188fd70fff97f0c80e16d2633d34743baa
- SSDEEP 192:iuflXVufSXuvufSjjj88888fTGRRsVZ2ttz33SSSbjkkrSSSxIvDvWMMgggJJJOF:J2T2dE
- TLSH
  T14F42790A565D49EF47F8C025B178B183CF892C516370273C36389FAB2FB69D4A699289
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral21 behavioral22
- Target
  UserSecurityManager/web/bin/WebConnectionModule.dll
- Size 111KB
- SHA256 bb82dc63a70ec928d342d25622505b68ed4aebcd0f9006e3d9b8db823173dbbc
- MD5 ebb1d595cbda378d1fc318374dfd47d7
- SHA1 3e7394f07621cb9b7045b1b95c81fbe3260a8456
- SHA512 fbc1bce0e75216bf2ad137804e7c40bef44102017acc977fc748a2e9361d72f228b809cc1659ef63c790aba1f7489595de66892015a7a1269dff9f7b43088285
- SSDEEP 3072:DPGfYai4QVGw9Y9Pr2T9Tf6AK7+Gj2Td:T4Yz7JYP
- TLSH
  T13CB3922373F84A05F2FF2B7AA83551140BB7B8466831D65D1D9C648E0FB3B508962BB3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  UserSecurityManager/web/bin/wc.dll
- Size 178KB
- SHA256 4754198d875e204f42a18fd66c9b2bd5b2287d11dd81bacdcf87c7efe18827a5
- MD5 31319b07c5b8422733fa0a7d01079d7b
- SHA1 ac74f98e3366c89f46fe292d0dc6744524b3e518
- SHA512 d648540b7b2d5d1cbdbac333300a1cc8f4197d776483858c4b5b70d302b14089ebf4514d8a2f3344e8d723d9d0f60d6056ec383edbd7ec4b49cb33cf0b4abcdb
- SSDEEP 3072:EIa5417oeq63ZewHQzvUohzbqSAOt2qGvWpBYXJvXAMDKFpapJCHbYQx:S54Fdl+Ukb1AqOWTYX1x+pap8HUQx
- TLSH
  T114048C01B5C0E43EC27F173415B6AB612A7C78701FA984D7F3944E6B5EB42C1AB39A27
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  UserSecurityManager/web/bin/webconnectionwebcontrols.dll
- Size 129KB
- SHA256 62c5d9b75436017a12ef58a1bb4e1b08731bdd67ea722975871328b965b7f872
- MD5 d6648c05c280c2fa3b00c46cd15c02c1
- SHA1 04e396cca1ef5ea8eea3892952030f71895d8f78
- SHA512 c312579ec3d2664f6811d6e29323aed3d7383ea6975373824b504f3769e2c2636f7781a61d35f36c3cc5f1b917bf9e2c853e44bf53bc198e74d2fc5e4eb83cf9
- SSDEEP 3072:qOIu6MaCQOZwueh+Y2SswDXhZYhxlS1dTf:qzu6MaCQOa3aSsEhmS
- TLSH
  T171D3B6192B9CBABEE2AE077DB1D5D1B0433CC1486563EB1C1785309C6877760CE53AAE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  UserSecurityManager/web/images/SecurityIcon.svg
- Size 1KB
- SHA256 46b8ba3886e3fc3a962f37a6e37a817568d4e9734d25c541fcfa9c63e436bb80
- MD5 7d85f5fbafbde57742c877110f4e0703
- SHA1 735c08f527c7aa0c07de3910efc3adf0668bf663
- SHA512 2b775e65df39f05a50084aa290ccba48c49e968143dded08f406f70a2d039ce292ae8f877035ce892b7dcf7ed94658ad1c71df3fb8bb3b793e1f6bec3202a85f
- TLSH
  T10941CF47C2616779FE8D81385294249030F0CCDFB4A1F188BBAB0459E5DD4C43AC9BEE
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  UserSecurityManager/web/lib/bootstrap/dist/js/bootstrap.bundle.js
- Size 207KB
- SHA256 3290ad3b8a579ef3bc11c67daadde34b8c60537e337ac6249885d85d13566363
- MD5 50a98c751c19ae5ea4fc42b2ba2da89b
- SHA1 56368d3745a9fb9e81628db25dd5995bc3c31add
- SHA512 692244e33afba158ac6bede41a3632eebf5ae0800fd9f5e7126727586e6a0431c4ed1136bd12544fc6e9a6984f5f12f7e449c8f12997cf0eefe9c9c3909793e8
- SSDEEP 3072:fVio6+9ohcZMJ65mqjBBK5xHWnRYXDZrCj6q:r6+9eUMJ65fjBBK5xIRYXD8j6q
- TLSH
  T1E324850A7DE670E2456BF13E87EF5149F234505B5609E9007C8C97E81FA0E3492AEBF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32