a7d175b59884c309eae502a6ece322c185da48461637272cf79847b7f66d6df8

Sharing

Copy URL Twitter E-mail

General

Target
JeffMacro Setup 2.0.0.exe
Size 73.6MB
Sample261030-yfa1rsfd75
SHA256 a7d175b59884c309eae502a6ece322c185da48461637272cf79847b7f66d6df8
MD5 98c22384d08dfd91e8c60e272256721b
SHA1 8be79579201286ccc27135b60c2cba855a1f97b2
SHA512 68a11e31add801ffc84c909aa08687b75e3434845849c608c025b3ef2adb3002f079437cce028b3b33106d62ee89e164af37749f9c6bf62ea91c7332f38bb31d
SSDEEP 1572864:fi2um4Ndc2lZuu3GHMoVTfGguSHIxwX9fraUgSqHMlBhHEnmKOk:fiTm4Phuux84So3bnMlrHWms
TLSH
T1D1F733C590E09040E3558B329791C67203DEFFC94AD1B92E33E51EE73327A59EEE161A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  JeffMacro Setup 2.0.0.exe
- Size 73.6MB
- SHA256 a7d175b59884c309eae502a6ece322c185da48461637272cf79847b7f66d6df8
- MD5 98c22384d08dfd91e8c60e272256721b
- SHA1 8be79579201286ccc27135b60c2cba855a1f97b2
- SHA512 68a11e31add801ffc84c909aa08687b75e3434845849c608c025b3ef2adb3002f079437cce028b3b33106d62ee89e164af37749f9c6bf62ea91c7332f38bb31d
- SSDEEP 1572864:fi2um4Ndc2lZuu3GHMoVTfGguSHIxwX9fraUgSqHMlBhHEnmKOk:fiTm4Phuux84So3bnMlrHWms
- TLSH
  T1D1F733C590E09040E3558B329791C67203DEFFC94AD1B92E33E51EE73327A59EEE161A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  JeffMacro.exe
- Size 169.1MB
- SHA256 0e014f5033b6ac2246869bfd77bce9b6b4486f18ded92bf011b2f281e420cd69
- MD5 364d93175eec68b3d62178f9e1598e0a
- SHA1 380e1825a126f1457b4be509bdd5c55ce2b501b5
- SHA512 38be9e016577127c031cd60e88967f09dce4c6781d004732ae7ac106b1eccfad561a9175c265ad6718ba08ac3852f2c3ad1f207affd34f98de784f228ae8ecb3
- SSDEEP 1572864:ZMw5SJUgPbksdRW8YcrVEGPv/fNsYCdwl0KWCfLM14GYoQt0imGWgyTpQGa:FunRK2agyVQ1
- TLSH
  T1A4888C13E29650D9E00DD1B187879233EA72B84A4728B6DF2B544B563F77EE42B3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral11
- Target
  LICENSES.chromium.html
- Size 9.8MB
- SHA256 c4771c9158e31855293ee565db76c9b2c52f84c8a37eda4700cfb149a17fd7eb
- MD5 0ff177fbf2a3873dd573077840e0b8f5
- SHA1 03d06bc7cd894399a5fc6600a0210f6e3226f92a
- SHA512 3264becd3103c905ab7f9cc034320885f18cbecaa45f582a4a9567ca4bcd620d64dc59fb03532964e775c35f07928a4497f5529cf1b9dc18379e4e9cff02ff8a
- SSDEEP 24576:K+QQM6Ms6x5d1n+wRhXe1BmfL6k6T6W6b6f6V6GeGj/3BIpx:LUzeGdY
- TLSH
  T134A6A52F7B48037706C642627B8BA5CAF21E903F3B561654344CD1681F6BA2983FF6D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12 behavioral13
- Target
  d3dcompiler_47.dll
- Size 4.7MB
- SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
- MD5 a7b7470c347f84365ffe1b2072b4f95c
- SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
- SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
- SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
- TLSH
  T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  ffmpeg.dll
- Size 2.6MB
- SHA256 18b1f088c7a1261c5fedc46eec98f34e79655128110a6f6c0b9bf62be22dbc95
- MD5 7826cf6f81ef54e9fece6a9d5a0b7bba
- SHA1 17f0ace5f39dc276790ff4f427f3112de9ae9baf
- SHA512 1db8e1fb6da58401d384e26e9353e5461ccb8d5a5d98fe1cdd43455d3813358b3fcc010d30090f78c59d739a4bfd84a77a0c4eaffa4f270460964301d5c6f4db
- SSDEEP 49152:VC8lp7/1UNZrhOP9YJQHUOWwGen6yfW0OfShPdb5x:ChOVYJiUOWwQaPB
- TLSH
  T1F4C5AE02E6D904DDD02DC0348B9B9223F63174468B24A6DF1A91CA253F6BFD46E3EB75
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  libEGL.dll
- Size 469KB
- SHA256 76efadca4ef6d2abe6ab3701b4071e04470eebfeed8d8d22c7252683bcbb37b1
- MD5 f8b7a8587b0826f969b2ccddce77879d
- SHA1 028af2adc8d467fab7d9d1ed620dffcb9a4bf3d8
- SHA512 fa7b8903aae02f57548754ff6ed8ba8be35e4b18a2fb06cfb9246a0c67105650f08cf9284521a291d387e5216e32533825a4a41d7260a4d80a27c9e35577d57d
- SSDEEP 6144:DmfOX/zRR8yWTDLMoqbAIbqkpXy0/KQPJVIJAG:aczRSyWTDY6IlpXy0/3hcH
- TLSH
  T13FA48C1177D444B9E06BC134CA534642EE76B8960F65FADF02A492392F7BBF85B39320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  libGLESv2.dll
- Size 7.6MB
- SHA256 150a02e43426a0886f023e88cd88454fb0e78696ea3881347a6256920c7a02ba
- MD5 c732c32f5f2f8736f9141de29cdc2a9b
- SHA1 d4cfc6caba27f21b75eca36d7e4b5145c7eea7d8
- SHA512 a55a09f63cb1c46f31e24f42049c8374f6adef49c6a69da136b37807efdb912730d63f712035b0214688ae5b86f02f828b9ec326ccc9b4fea65227ca1292cbe2
- SSDEEP 98304:OlaVNd6hP9OPvwfWm6sGnoDgCXm3o7KXy:dClGwpvGngCuK
- TLSH
  T1C4867B03F29640D9D04DD2B59B4BA223FA35B8850734B6DF269413253F7BBE06B3AB15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  resources/app.asar
- Size 1.5MB
- SHA256 dd6a2bbadcfea6648a681b7403e56ebecb8796779c4db54c6dafd4999e0b73a0
- MD5 114c61b860a9500292a9d037e5dc05c6
- SHA1 a832fb3be3541a0f2aa33b36840f0f639e37bb6f
- SHA512 e46df03ddcd2eb1d5051e7ca301adc1e2388a36a2e1618c6277a41e6d0acf5b5291d610e4eca8bef2e0bb44964f5ffd98d73258cefbc6204b6a9b181ab985056
- SSDEEP 12288:xUiYVfN40kApqEUEeS2TGRNj8/M7axsy05eo1pEXVCqW5/q1gkApqEUEeS2TGRNz:aiYVfm0khao6Z8IZE1gkhao6Z8IZE1I
- TLSH
  T16875F1D832E8B261EA1745B2005BC63B372A1F53580C88A070DCED9B7FA58865577FED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral18 behavioral19
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/build/Release/uiohook_napi.node
- Size 169KB
- SHA256 4434544b06cb46869b829766178f49f87a37d4d6dc925abf2dd2ccf0be82c6df
- MD5 c7767285e92c4e81017701c304889db7
- SHA1 af7244b612981c18ee907d35751f16806149e9b9
- SHA512 1ad3363d04cf82db4a728b398103cec95e75c25c89ad841ca62b623b0357519738d831cd7476717ac62aa7f5dd63482237bec5d5c1c131225b19c127da334c7c
- SSDEEP 3072:zWVkBE02DEwzWbgJr6/XE1U6BXjgBriKdg5p:wQEL9H66lTf
- TLSH
  T18E046C5AB3A901B7F5738238C9938A12F772B8111320ABEF43A086755F277D19D3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/dist/index.js
- Size 5KB
- SHA256 b927f8baf1180d79592900cd3a5eb5bd8ce2c2b0dcfe8a7da58fd37891d64b6c
- MD5 6b5ac1af73fe5f624256825056e45b9e
- SHA1 0da2e8e5423b47dd20fd6dbe8e2e57cbbfcd8fa7
- SHA512 ff25b38bf386feb78944de2ea254256f22d073456d2cba3dcc9946d4c678903310bb698f686fee2c7c2501b25934d1644c019221c4bbbf4113e739b5581d09a0
- SSDEEP 96:KEWFYlAoZwywlJ89xcSrZXglRBSwda9idbYmeXCxDerfi1+p:KI9zmAcSrZXK2JidbYmVxDIi6
- TLSH
  T14FB1E09679D22998723367C8072D811010776A276CD8BF96B47C4F58CF8F49D20BA7BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral22 behavioral23
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/dist/prebuild-test-noop.js
- Size 120B
- SHA256 9a7b050e26b0ee0076ebebe7b44e779d1b4b90d50331550316b47ba1d82b8cfc
- MD5 5c8e9bce873f720d31f6c6ef53a5360e
- SHA1 5bfcf7d8f8ea1c85664a1bef83da9ede191e121c
- SHA512 eeb0c03b7dccdba5a802d70cb7d41dd823dbb4f715e4303bab886a9ffbdf5903c266bd3d881d7537463f072506a6e6ff514b9240e30e3be5dadbe38cc713ab09
- TLSH
  T120B022FF88B3088C3F800EEB00A802C2C032C2F0E8820002C00300B8803A822223AE02
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral24 behavioral25
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-arm64/uiohook-napi.node
- Size 68KB
- SHA256 8725ed2668b6f48e711ed8bb861106bc3b77eebddd76d02226f2c6e8704b687c
- MD5 61fa1ce93d4a935a671f4ab11d5da6f9
- SHA1 bfe4f2bc99e7d87c791cd95b63b8b192f16f7c8d
- SHA512 146e2f6b46a317c19c1778231ffcca55d925f212c3666600a4764cd2992e9d9938bd324393004d3bc1e87f92ebecc6033b20ac1cf4f02b756089961ba5de10c0
- SSDEEP 768:YVGvPPCfo35RZhJR5BpxZhJR5BpxZhJR5BpxZhJR5Bpxs0ckMU8Es0ckMU8Es0c7:sGv1+V444W8Lm55S0HYQzqSIyd
- TLSH
  T1C963F60FF124997CC4D4D036EA9BD25211B1F078A930163FBF84E37A2DCA6AC456EE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral26
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-loong64/uiohook-napi.node
- Size 68KB
- SHA256 8725ed2668b6f48e711ed8bb861106bc3b77eebddd76d02226f2c6e8704b687c
- MD5 61fa1ce93d4a935a671f4ab11d5da6f9
- SHA1 bfe4f2bc99e7d87c791cd95b63b8b192f16f7c8d
- SHA512 146e2f6b46a317c19c1778231ffcca55d925f212c3666600a4764cd2992e9d9938bd324393004d3bc1e87f92ebecc6033b20ac1cf4f02b756089961ba5de10c0
- SSDEEP 768:YVGvPPCfo35RZhJR5BpxZhJR5BpxZhJR5BpxZhJR5Bpxs0ckMU8Es0ckMU8Es0c7:sGv1+V444W8Lm55S0HYQzqSIyd
- TLSH
  T1C963F60FF124997CC4D4D036EA9BD25211B1F078A930163FBF84E37A2DCA6AC456EE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/linux-x64/uiohook-napi.node
- Size 68KB
- SHA256 8725ed2668b6f48e711ed8bb861106bc3b77eebddd76d02226f2c6e8704b687c
- MD5 61fa1ce93d4a935a671f4ab11d5da6f9
- SHA1 bfe4f2bc99e7d87c791cd95b63b8b192f16f7c8d
- SHA512 146e2f6b46a317c19c1778231ffcca55d925f212c3666600a4764cd2992e9d9938bd324393004d3bc1e87f92ebecc6033b20ac1cf4f02b756089961ba5de10c0
- SSDEEP 768:YVGvPPCfo35RZhJR5BpxZhJR5BpxZhJR5BpxZhJR5Bpxs0ckMU8Es0ckMU8Es0c7:sGv1+V444W8Lm55S0HYQzqSIyd
- TLSH
  T1C963F60FF124997CC4D4D036EA9BD25211B1F078A930163FBF84E37A2DCA6AC456EE94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral28
- Target
  resources/app.asar.unpacked/node_modules/uiohook-napi/prebuilds/win32-x64/uiohook-napi.node
- Size 169KB
- SHA256 ee68f046628d2e4406d8aa85c6489ad06578b64a0e19ed64822bd22e7c473b85
- MD5 82e612203bc33ace73c4ebe66cebbb41
- SHA1 5b012dd261eb1f487f3947320ae9a12e07fedd35
- SHA512 dfa4deafc4df1ec53cdba158b24a9f8367aec5c8a54b690bd77df835d9b21d93e5f9715a865c2f2232bd3c0b24bef80c33942dec6001aa0ee8731e4476c12890
- SSDEEP 3072:v9XRcu63JYKm/wWARqHb4R2SxvUXQW50IaudkT:jcu87pN3VU1d+
- TLSH
  T1F7047D5AB3E500B7E5B28238C9539A02F772B8111760ABEF43A087756F277D09D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Command and Scripting Interpreter: PowerShell

Checks computer location settings

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32