c27ffc77d85b6926a5d5478afa5bd1cc9e2628fa2ac779e506a1f799744f7a7f

Sharing

Copy URL Twitter E-mail

General

Target
Trauma-Lab-Free-Setup-v1.22.exe
Size 108.9MB
Sample261102-blh71aztaw
SHA256 c27ffc77d85b6926a5d5478afa5bd1cc9e2628fa2ac779e506a1f799744f7a7f
MD5 cf271a68277c850c0e6d223474e0392e
SHA1 ed4deba359cfc292f25216f9679d6f242f614b88
SHA512 64da0373f67f4fa12be4f3b5dfc417fc77397857c5b6fbc3eb15a55b2eddeb6ad08dfcb43364901edcc7510e564e77f480183facf493a9f52690fe000a783206
SSDEEP 1572864:J83/zgkbZcp3hplZtQltsPY2LXvAPj7+irEHuid6bncaT73+vh1J67WLS88:J0Rb2Fai8Pj7+MEHuisnbv3+vhr67np
TLSH
T1294833D43D6DBAC5FEA48636C2ECAAA5FE5C10AF186817570F0A3431FB970914C6DC26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Trauma-Lab-Free-Setup-v1.22.exe
- Size 108.9MB
- SHA256 c27ffc77d85b6926a5d5478afa5bd1cc9e2628fa2ac779e506a1f799744f7a7f
- MD5 cf271a68277c850c0e6d223474e0392e
- SHA1 ed4deba359cfc292f25216f9679d6f242f614b88
- SHA512 64da0373f67f4fa12be4f3b5dfc417fc77397857c5b6fbc3eb15a55b2eddeb6ad08dfcb43364901edcc7510e564e77f480183facf493a9f52690fe000a783206
- SSDEEP 1572864:J83/zgkbZcp3hplZtQltsPY2LXvAPj7+irEHuid6bncaT73+vh1J67WLS88:J0Rb2Fai8Pj7+MEHuisnbv3+vhr67np
- TLSH
  T1294833D43D6DBAC5FEA48636C2ECAAA5FE5C10AF186817570F0A3431FB970914C6DC26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
behavioral1
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral4
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5
- Target
  LICENSES.chromium.html
- Size 5.4MB
- SHA256 7dac8267ac6da8d959cfe88f5f055b18a397f10230380b5329125e167bf5639b
- MD5 3f5d5669497c9d912e5f0412611f992c
- SHA1 4294658fd6a5be492b8745b6cbfca923f7344b2d
- SHA512 e2c2084a34dec1b1009852dcba37912af48140e127029e84c73021d26b724d679b58f8fba2bd9319e20d026c52798401ccbfdb883088992df0724ec82dd7b22b
- SSDEEP 49152:jCrmWndoHTYp22kuCenUBFIdACi4WMEAUYw6cif:+
- TLSH
  T10446C66B7E49037306F282616A47A5CAF31FA03E3B5A1654309CD1182B7BD2583FF69D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  Trauma Lab.exe
- Size 238.3MB
- SHA256 5e9e0b8cad68513849ddad82fdca027648ec125e54bc62b951fbd356dfff6ff0
- MD5 7ae66ba6c7dadfff3d289691f4da7685
- SHA1 ea6187c3ad1a6a9085226b6496f10242d54b96af
- SHA512 66615ac7f23b7189f4c39351513cf5f84cd11ae06e85f4e4324135c7eba09fd7470d18ece9af206ddab156192bc7faddd73778493a928ba361a9bc5c7e5a7030
- SSDEEP 1572864:gI3/VR82wZHoiobXsmAcfxy1eLk3f72msgaA4tpSariWp6LtcbvtGGwGbE8Stjwa:Bn8GtfBxvs13c8IS
- TLSH
  T16DC88C03F29A01E9C05DC1B9975A9633FEB1B8454B24A7CF2B5447521FA6EF82B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware stealer
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Reads ssh keys stored on the system
  Tries to access SSH used by SSH programs.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Service Discovery
  Attempt to gather information on host's network.
  discovery
behavioral7
- Target
  d3dcompiler_47.dll
- Size 4.5MB
- SHA256 f5c95e919b4ffa1ac71049cd45b9f986d2965e6888395ca2806337985334fa56
- MD5 f7b785e9d2d7a4ebd6374a555063a100
- SHA1 da162478b19b05fedc9d8027bd182f6beeecdeda
- SHA512 a287e97b14d1f66783e35f295dc0f355a1da1215aa514d307a01d31b12dd29cc4e9f591281ed6b4f9d8fc90fe7d647ae7d2ef0ad2c989c9dae2123462006776d
- SSDEEP 49152:7MaW1H1ZcPsk9HOJLjJP73tSjPM2gjg9aIhR46LUbOWHHJdsCIdkTYoHjnTVyNMx:0cPsguxj34bwmvD3emt3Dnkr
- TLSH
  T148269E56B7E850E9C1BBD138C687861BE7B1B80513305BDF02908769AF73BD16A3E724
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  dxcompiler.dll
- Size 24.6MB
- SHA256 6af17f483f97ca18b579da8475855469dde1b69b7e7872cae13bcbacc2d33200
- MD5 49fe36c36f9d6e816dc20bed1817f01b
- SHA1 c7e14db7a7436268f09a439683d8955a2f898c3b
- SHA512 cb0049b2a02891200bd7d552d0beb60e2661259b293942bfeabd92f90701dfd101ad14b7f74723bf984ae26c2a584e2dfcb3cbc4f60cbbe0afbafb82273576b1
- SSDEEP 393216:CTnPNWv6krpad1ue1hvp4QdQFygqJ/DVi5wFj4:1advHp4SQjqVDSg4
- TLSH
  T1734729122646D49CC099C879C7678B268A6C30E73FA7B9EFC0F451212B79DBC5B39235
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral9
- Target
  electron_wer.dll
- Size 415KB
- SHA256 234b9aba3c2c5bb545dedb26783692ec90313a3e17a532ae7c514f8058adf117
- MD5 2f239082cff4b1d0b5fc66b559a3bd7c
- SHA1 6f643de2a752aa49a892757e66a4571cbf5932ba
- SHA512 abbc55b35e94c33017e8dab1c8a503da3c5c72760e8767631cc156fad320d63ea704e9e8c46ac78691a6aad2c357473d796a49dc2ac688f3174c1420c97745e0
- SSDEEP 6144:0jYlWCwLC9fw6oCh7eU5BkNICuvIHvK6vHuyqkC6hMascq:ufC99o6oCh7jnkNICuvIHvWyjC
- TLSH
  T1D4948E04F7D448F8E07BD0388A278642EF71789A0F61E6DF03A456692F37BE45A79721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  ffmpeg.dll
- Size 3.0MB
- SHA256 cdf2b70f0f0a97c9840af1466dd86a90e564c98f6892d783635cf9c3b303d613
- MD5 d8d488ec2c3c99ecb9a1dd1b7e6133c3
- SHA1 e991bcef296217721e38c25e5a7d417d6a49f5d8
- SHA512 5f58559ca805c07a4041ff73cb369462bc1e694643ce3fc62b115711cf6b4aee97a927ed888ced67a25b72e8262ee757b69fe23adf693991ce1760cca91a23d3
- SSDEEP 49152:fjAmYvxRVRNqC/2t7Z+3/6TiD7NyzuCPKgc5mar9Yhp1EY2SDqk3hpygdiJyy1Nt:8LRVut7Z+3/o2Whi3
- TLSH
  T13BE5AD03F2E651E9D019C43497AF9323B674780A8F1099EF17905A252F67FE86D3E728
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- MD5 792b92c8ad13c46f27c7ced0810694df
- SHA1 d8d449b92de20a57df722df46435ba4553ecc802
- SHA512 6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP 3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
- TLSH
  T1EBB37C1274C0C471E5732A361974CAB14AADFD700E759FAF6398127A4FA01D09A3AFB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  vk_swiftshader.dll
- Size 5.2MB
- SHA256 00d703c0557b54edf35c284b15cb0063de1653edef71d33c698a64d2e74073c9
- MD5 98642220caa57916f52465ed7e94cd24
- SHA1 adc9c96a2c4106731f4478d9ca8563e6069dc444
- SHA512 0ea31c78a854ea204cf4aeddea46551f74c8f123bbf991dd67682f613e8d6806d2cbbf0f9e87799a479c3ebd40348935af26e841790e441f33ee255014b9fc8d
- SSDEEP 49152:DmSJKWEgDtaN8gXCoqqW0QtP6pe5RRKc96dXi1TifpAVvH+hMp8e7pMAqqAzHj5Y:DnKWEcHdUIG5wFFLv2
- TLSH
  T18F464903F28581E9D06DD579875BA623F672F8840B22B7CF56A00F192E66FE0A73D714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  vulkan-1.dll
- Size 935KB
- SHA256 0802c28ebf8226fccaef45fc44b528873eb4814f714a817b01cc2f6ab49c24da
- MD5 cf41ff11a8a13770f1e4b332a76f01ee
- SHA1 d288d5b650ecc5c44d2f046e69c69c01eebcdaf2
- SHA512 e35c7574d532efc369ddb99a417e8d1432c83110058657ccb4204f88bf3e97002269e753643bfc2fb62a62ad9dc0c3ac75aaf197e18e1eb6bddad717a24b6484
- SSDEEP 24576:PgWZPASFfqoy6Cko/hHMDTCyXbKNlC1E+Dkw7+Dv6g3v0TAE7yoeHbP:PgUPFyoyf/hHM/CyrKNlC1E+Dkw7+Dv9
- TLSH
  T162157D53D5948AB9DA7B8078CCD5490389F174A11722B6CF02B807142F5BFF46BBDB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral14
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- MD5 80e44ce4895304c6a3a831310fbf8cd0
- SHA1 36bd49ae21c460be5753a904b4501f1abca53508
- SHA512 c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP 6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
- TLSH
  T1E9949E22B6D2C036C56E02309918F77921AEB3B1592DDB1B73985B6F7FB44C19E24B07
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17
- Target
  $R0/Uninstall Trauma Lab.exe
- Size 243KB
- SHA256 cdb8a3ef9f43d3def0357e4ae93c7ecc619d9491db75bd33ef9f4c54add3d9a0
- MD5 834e0c3cad828cbbaacaf99a7dcb8de0
- SHA1 4303ec12a605580d9efa560c489c179d344c272d
- SHA512 15c71cbfe23ec491f531cf3edc2753cad1255d4181c488932b0407af7a9857ec219f5fce4f2b3d472c10662a5e7609659451543c800b5f2833afc16c0041e7a5
- SSDEEP 6144:s740I4+gctm16VbQ2InPrJAkKY/yLdqFUa8T2t0EyL+yae:OYbtzIlAkD/YwCLRKJe
- TLSH
  T1A234015CB3B0E867E4F64F3153B5A3CF5A3AB01565284B833BD4121D7AA3251EE1EB42
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Command and Scripting Interpreter: PowerShell
  Run Powershell to get system information.
  execution
behavioral18
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- MD5 c6a6e03f77c313b267498515488c5740
- SHA1 3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA512 9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP 3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
- TLSH
  T125A33B62A2FA9CF5E4E70B3D1469BB264CBB7B383431D93F2342054B8534586DA2D35B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19
- Target
  $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- MD5 0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1 48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA512 c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP 192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
- TLSH
  T1BA428E12977049F2F1A0183C10A67F265FBEAE5C1BE445A39FE380867D652DF9436343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral20
- Target
  $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
- MD5 adb29e6b186daa765dc750128649b63d
- SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
- SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
- SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
- TLSH
  T10F623AAA62E847BEE2221636B96723130BFDB5203DA1D01F4D531E596C30BE3953D61A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21
- Target
  $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- MD5 1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1 0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA512 7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
- TLSH
  T16A51365F13BED7A4C3071738A6FBDC85749B440012C659558BB2172ABF141E0BB3CD08
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral22
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
- MD5 466179e1c8ee8a1ff5e4427dbb6c4a01
- SHA1 eb607467009074278e4bd50c7eab400e95ae48f7
- SHA512 7508a29c722d45297bfb090c8eb49bd1560ef7d4b35413f16a8aed62d3b1030a93d001a09de98c2b9fea9acf062dc99a7278786f4ece222e7436b261d14ca817
- SSDEEP 192:olsHeylO012En8pqHtcE0PuAgkOyvIFc:oATI0d8pUP0WAgkBvIFc
- TLSH
  T1D0120892E6E450B3C5D6133F35AE2B2DCBBD5329B0922C0087738E4979795B66E38347
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral23
- Target
  $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- MD5 ec0504e6b8a11d5aad43b296beeb84b2
- SHA1 91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA512 3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP 96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
- TLSH
  T173D109B836C20CF3D54E46743E22381713FEE4761B7502A18B976ED61D92AE2FE20781
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware discovery persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral24