7d95c83cf9dc6f56a55aaab34c1a78295afafc8d7fe2ebabc78051438025dac8

Sharing

Copy URL Twitter E-mail

General

Target
MidiVmRunner-v0.90.zip
Size 67.0MB
Sample261029-2tkc5stvgy
SHA256 7d95c83cf9dc6f56a55aaab34c1a78295afafc8d7fe2ebabc78051438025dac8
MD5 aa4f9d49aa7cf74610521dac32776f20
SHA1 8e7447e43716ef4f598266782a22d5985209c238
SHA512 db862760de45cb5cfd956ff0e977ad244a68d3a442447088718ba11a807369b3fc006533568e69e194931f4d82a0fa5823c972a39dc1957d89f31da1957eb5b6
SSDEEP 1572864:i88AdOulYeXqppiCJ9UgZtMcAuTYy9bUjv50HrR:BQuKeapphJ9Z844rqLR
TLSH
T122F733DC73BE355FC8AEE836ABA32509A452C39B4471FC9F548078C5C3E62D667AC601
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence ransomware

Malware Config

Targets

- Target
  Accessibility.dll
- Size 20KB
- SHA256 23cb3e98edb2457af9284abe13c54adcefcce3531ba5ad236ff58737fae44cfa
- MD5 150301d2b5a0ea9215d75ab819149161
- SHA1 83c8dabb00abcd0841d876a31d743a40518a92e2
- SHA512 95875504a2a37d04bb449fd125aa45bf6c97592d29e0e7a27f52b32a70ccb6f6668bd9a6d94d546474c2569bb1746749f5e8749945e4bf3a72453e8bdc46fe72
- SSDEEP 384:gBmy0h6gSGRcOcHi5W2T/WjZlNzgoUwleR9zE1X:FSvOcHG0Kz9zIX
- TLSH
  T1ED924B93F758E152ECBB6A7159A8EE463E34E7861912CE6B085DE24D0E433C4CF62335
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH
  T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  DirectWriteForwarder.dll
- Size 509KB
- SHA256 bdaacac565bc5042cfdd877c894b79423fd5afe82c116c67c49d7aa5224fb5f3
- MD5 4f4c154135f80470c169a888e3bd57c0
- SHA1 6680828b1309e51db872baf872c5dca7ad7bc5af
- SHA512 5a5667675db51c9d1fcb8ed69ad07c93e2f90e40e1f67efe8aa4a739aeff6dee94ea8bb0b3e4b72f736aaf8f4ae7fc8c0afb22217c37c3789d6ac41b989d70ec
- SSDEEP 12288:jtdojEmHs08+iwarHLMvUQ5ZUKQ0cuv+Lf:hYEMilLMvpZxouv+T
- TLSH
  T129B4AF15B6C42A53F52DC2BFC213C652D63099F24323E7C7864186A62E2F7C2D77B5A2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4 behavioral5
- Target
  Microsoft.CSharp.dll
- Size 981KB
- SHA256 25b1a19769bf0c251e52e0aa0407fd2b34b1b3d0279e22f355778d748da7a578
- MD5 b4c434b5145ed6770edab1c8db46a73e
- SHA1 94083cc3921bd7ce8683e9486141828660243cb5
- SHA512 7258c2bce54b2fb6573cd0a4661736a437276d45f7a286c1e8a54b808f5fe36e530b28b5c8faab3c3d41e9be58c817b0057f15a3cdda81e084fe872583b36796
- SSDEEP 24576:66qJq30vVE6z8LpeNY+9whtbShFtHVu9yHCsC9DUD3IB:cQ34VEYKaY++tbiHVu9yHmgrI
- TLSH
  T177257B14A3D44E06C2AA877CC2679602D6F1F453D33786EF0484EE752F837C29A77A66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  Microsoft.DiaSymReader.Native.amd64.dll
- Size 2.1MB
- SHA256 315a61c47c41b8d4c815f4274bb6584c1d24b4640c7eedc354ed5b03a9a1361e
- MD5 e4dc9335fb0065d4b3066fcb8a878a9a
- SHA1 0d66f04b77a0726f1bc2077675d485700848d9af
- SHA512 929eb77e8b843e484ee74b408edfefffa15d0ee75d70d3b47a808fe380eeaaa9dc40bb29ef549e47e89dbeab159f806b4f823e8d3dc85e657f7bb32485a1c947
- SSDEEP 49152:8oJlAZFbi/H3LzED3pattTg4nm1OPriyQ:gZFbiPcEHg4mUPQ
- TLSH
  T1BBA58D97A3AC41E4C47AD178D66B460BE7F238050321A7DF02A0863E7F67BE15A7E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  Microsoft.VisualBasic.Core.dll
- Size 1.2MB
- SHA256 2049b733a859cea1972ace6ff4eeecd1faa4d625304315dadc353a5b569c4563
- MD5 1d1d5d6a4313f022b74d13dfa706a9fe
- SHA1 b778974981c26db919d2b3ac84ba81be1bd7c618
- SHA512 26d4e3b35c8de112c695dbf48a664eec07e880e1da9fd905d2ef131e694475b4b687667c8fd02407c0804d0ff5a9b4d53a51d1ce3058e70d69e2ebfe8a1c1b50
- SSDEEP 24576:4svozOPj/l89Sk2f+/eOUCxRepC3/Rk3ilPFqUb:4svozOP7ymf+/TZq3it
- TLSH
  T105458E08ABD4CE07C32F93BE825B8201E1F1E5165769D6CB0458CD561F837D367B2AAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11
- Target
  Microsoft.VisualBasic.Forms.dll
- Size 241KB
- SHA256 c18f7d084850bf88734c4904d23f71e056e0a6595da63c20949fec11cbbfd43d
- MD5 7fa564ac06d2f2621af061cf82a79205
- SHA1 8abe82398e79e390924b2fd31ba29963360a9de1
- SHA512 8a2917160cd5f2324e98972586e4b34af294b2ab840895daff48c86713be9678c8d57c6ae96edbdfde275ac1d4f05d77311f58967290efd4f524347389110902
- SSDEEP 6144:PIA96ZlpKRRO48OkdzAbLbDme2tzi2bQah:P9ip4SdGHMu2Eg
- TLSH
  T153345A2763A88E1BF77E45BAC653C112D73195D70312C6DF06289A081F837C2AFB9D66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12 behavioral13
- Target
  Microsoft.VisualBasic.dll
- Size 18KB
- SHA256 cdb29280d4add72fb918f707d009ceb2bc2e876f753818d16c14c91f57e4e383
- MD5 ccf6baf7c6ccb6bde311000f4c18b6e7
- SHA1 a125853b526625d5935d10362f1b5280fd6a268e
- SHA512 f5ee2f3da3850795c588c03d2fbcd2b8d119cfe429fd569c72c57a3687794675bdb76f2a754474200b66c66adde3c67e62defa18dda4d53aefc1d1931a3b58c8
- SSDEEP 384:j3lgfnShxL2Gc9LxWmH6M9QdWQZlNnt2n9fPOxFR9z6L+:j3Gn6lZcRotaPO59zO+
- TLSH
  T1BB821AC586288523DDEB2BB15D97D7923EF597CF09B19AAB1448F20548933C4C63036D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14 behavioral15
- Target
  Microsoft.Win32.Primitives.dll
- Size 14KB
- SHA256 8ee447713e6a03cac414bb0ce71d57673238cab5a517d0cda0f6ec5634dd232f
- MD5 8e80b444ee41904ab35c60aafc8043c1
- SHA1 ca4f48048c6aafadfd214a4626df3488b7a70c4c
- SHA512 9eb031a623a77720c078276cdef1433e7905e955647437fedbf136741666e44d25726278b64d41915cc501c0edef0b6daf723fe7ecd7e08cf4faf5459bd227a5
- SSDEEP 192:XGQbiBp/x1YWhPbpWbBWCWKie1BzBWsea4WZGMsc+6UQ/X01k9z3ANUob3W2OI:XvbiLJGWhPbpWbxZlNbrj/R9zb0yI
- TLSH
  T12D625B82C77C5203EDE76EB09AA4DA833D39A3C749019B2A19D8F5581C637C4DB3173A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16 behavioral17
- Target
  Microsoft.Win32.Registry.AccessControl.dll
- Size 33KB
- SHA256 a285693e675e8d649a063a91d8844e86fd010023e6b62b5a5cc76330d63ccfe4
- MD5 a69f4194792556038a01754b3adc138f
- SHA1 ba8b7f8f6d4ade3c1146c5c6144fb954d95ce576
- SHA512 239c976bb7fa3782e752aebf51a199cf6662c8f13fe894068127ff0233ca442b87bc8cfc7c89001d20b25bc41bf47a41628fc3572255a380c48d2793982438f7
- SSDEEP 384:VWFlRrWb+nHH4KR24502lNBftR9zaT/V7Ks:QM+HHzR24JfP9zY/Is
- TLSH
  T1B0F24B17EBB44623EEB54C30AAB6CA517E3AF7CA4C12975F0499E1091DB37C4C632639
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Microsoft.Win32.Registry.dll
- Size 117KB
- SHA256 3188ba0561bd857dc39a76f5b50b1ee99192b22df19acda164c5171c96f5d7c9
- MD5 897fb09b004c7dbd2977b7c5ae14afd2
- SHA1 1424a3327bd3e00ec089acf42696ea02e573f082
- SHA512 b92dc16c7379db7cf8b6b10480a20c7397af746bb9e2c8c888b53c745a2297d834bb649968f143409e5a07ecf23d3801edde053a7b2793afba9dc2dd8deb26f7
- SSDEEP 3072:8110NXwrxR7wECisvqzJSvEVcULVicjiU1dcGj:zNIBFC6zJSvEVzzvG2
- TLSH
  T158C33A1177C4030FFAABCA7988628985E172E1871701EECF96C5C15E3F5BBC6E6B1601
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Microsoft.Win32.SystemEvents.dll
- Size 93KB
- SHA256 35dfb636273fe5821d645a4449897521723b5b27da1132c569753c0e45a6619f
- MD5 cbd4d23f866f2a8f7ca46b472d1b3a61
- SHA1 da7534e1ddc135a3359d8a089db390f3c136e693
- SHA512 b68b729a82e2f235f9cdc885aefd03771c9dc9aced7558afe01b1ce5cd1b30d2695b9f637441725257e25dd2fec208f3e5e0eef6d69d2ddc28b64e8d5ba02322
- SSDEEP 1536:XiRqeFai7eq4od3IljMH1dKCAw/4IGrdsDyjvSJJHHzT:X9eIiaq4o2jaHLQIGrxjsJHHP
- TLSH
  T10D935B1273940632DAAE8E3BAA274A01E534F5C76752FBEF52C691090F63FC2D775182
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22 behavioral23
- Target
  MidiVmRunner.dll
- Size 267KB
- SHA256 a42b581b00662a668c80cae5a3f1f0a22813c13e65f6f12b541ccc632445caf9
- MD5 938ae8c2d74090eb760247399e2f730c
- SHA1 adb1761cede87c90e5988cdfb22f763d66d529d5
- SHA512 21214b7cc6d11477406b18b269a65a3b094a2a552cda9f1ccf1b31c04247509ec8e771e556453e0bede4055e178711aefd488dee0cc82d50f5bfef594a46ff5a
- SSDEEP 6144:14UODJldOTpJOyzr0AG0QQ/BMCu5Lxtq0m:14UIJldOztF6N5LS0m
- TLSH
  T18644AF3063F40E12E6FF6FB8A47000254F76B91BB63AE74D0D98B8DD1A327816952767
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24 behavioral25
- Target
  MidiVmRunner.exe
- Size 260KB
- SHA256 61f1e5a7747562eab4eb787c5dbf93de6b8de3437cc14d6f00582190e9c8a9a1
- MD5 91a3f3323984563f2ce64badb40e444c
- SHA1 7c18a219ce88b73d72619b31904a5b47cb58a91c
- SHA512 356519965503594aadcd4b6b12f14a3e52c6cb675293a612a25247369d30f9c8ddd159e2ee94d71c7081480f79bafce660ed9b2db696ce453fb271c1c60cc9ac
- SSDEEP 3072:ZqeXA/4yIg9vkNPNu6H6xCYOiEUE265EJ5QfrBG3WBMC3ekzHuvUxtESimy70G6v:ZvgvkNFNaxm0EkJ5Q9/BMCukLxtq0m
- TLSH
  T1D044AE07A2A850BDE1B7D639C9A24C41FB7378598B71A7CF075049B61F66BD0AF39302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence ransomware
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Adds Run key to start application
  persistence
behavioral26 behavioral27
- Target
  PenImc_cor3.dll
- Size 154KB
- SHA256 cdce493d83cbbfd786ba9a6113458461859d2992a533a95ee5832a5c51614512
- MD5 93f667d126d9c9356db45711d22206c1
- SHA1 9ec4de61d53e9bb2deb0f8bc6cf899f0f82781cb
- SHA512 034ab160c7ad8c21dcc0f5c2e7d3f60aef9340b014d282b824a94d85f5302ce80065d1351a5d4d3cb3b4e33fe2cbf4d70c6311c07ca4ffae0871a5bcacd4208f
- SSDEEP 3072:SrndTvsZTCHO0A3I62EpLoUGhFoD5GqTuE9ZTTml7OMTjkFXdCgfzsvADiCAMvYY:cndDsoe3D2yLtD57uEdkCHAMMw
- TLSH
  T185F34913B6AC40ABC429D27E85D70645F772BC111B128BDF2260932E1F7B7D4AE3A395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28 behavioral29
- Target
  PresentationCore.dll
- Size 8.2MB
- SHA256 98b7f03e08a36672661ca8176d9106c31e85b14aa30b7cea3e2d3f76b74ec1ed
- MD5 fb8109c967959532df86ccb97698bcfe
- SHA1 44bf1290ff2320cc93e8b7ea13d32a91dabbe986
- SHA512 d4bdc94a0ebef86c3672488a506b6c36076593a6dd2181e84e5798866af179a551381ab7add8fd204a17f04728d1c8311765ec1e40dd11715fbb410664caa3fe
- SSDEEP 98304:q3BMY//NyoNTxUYnHjYnjWaOYZ/E5I3bKM35xIgDdv42ZleaKwu4cQxQ:O/5x/nHEnqaOQIgDdgKlZKDQi
- TLSH
  T1AA867C05F3944A35D27F96BE92E24123E6B0B0A32311D1CB345CDA296FA77D162F7362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30 behavioral31
- Target
  PresentationFramework-SystemCore.dll
- Size 37KB
- SHA256 28dd0df6deee523cab507cd2d199a19879d23e985ea634ef3f6919522a04a291
- MD5 0ea6c0404b77af011ebe33e8bdc907d8
- SHA1 14b0c6f2bc275ca2e435c925feefc19d54af468b
- SHA512 325c4cd77e39016e589a914b7388a21f7f296c88532657e36a3d1b8c0a187b81cfc79bf84d57a2da162d2ede4dba235d33037d474bf74bcaf9c8082f3705f0e5
- SSDEEP 384:8WZuUrLG8kxYuQ7J7ADw7VRE8QMrZlNKguO9R9zS/H:SUfGHxYuQ7J77VRyC9zMH
- TLSH
  T13E035A59C71C4601FABA8BB0A9719E83B934B3835B00A2CF4299F04E1D637C1DF7666D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Adds Run key to start application

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32