042bf8348b13fc315adc96dbd9a72f35dde6fe4bb8c077e1015b4346bae721a8

Sharing

Copy URL Twitter E-mail

General

Target
Corporate_Digital_Presence_and_Governance_Record_REF-09808612.zip
Size 134.1MB
Sample261102-mtxadavv2j
SHA256 042bf8348b13fc315adc96dbd9a72f35dde6fe4bb8c077e1015b4346bae721a8
MD5 5d17e927e33c993ec5bf00dded20af2e
SHA1 766a3e8b1b0a9314ff57f8cd4a51e94636ba8108
SHA512 d332cdd20e1f4d301a11a631fa714a9371b7c6481bace7e5b554939a59e0ce0bc112f9c44c3e6c5348767786a52e85b8d12a6dcd84f6c221a2b77a674721f9e9
SSDEEP 3145728:M8/atr1CdivFxJfr7ja4q/nnvJ/MFaI2tCDVFmb+SzBFq5:3/+DJT71q/nKF92f+S3e
TLSH
T1EF6833DDA8F9A843C8BBEC7179C97D7D0283028C5ACFD104ED855FA51B19DC316868AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Corporate_Digital_Presence_and_Governance_Record_REF-09808612.zip
- Size 134.1MB
- SHA256 042bf8348b13fc315adc96dbd9a72f35dde6fe4bb8c077e1015b4346bae721a8
- MD5 5d17e927e33c993ec5bf00dded20af2e
- SHA1 766a3e8b1b0a9314ff57f8cd4a51e94636ba8108
- SHA512 d332cdd20e1f4d301a11a631fa714a9371b7c6481bace7e5b554939a59e0ce0bc112f9c44c3e6c5348767786a52e85b8d12a6dcd84f6c221a2b77a674721f9e9
- SSDEEP 3145728:M8/atr1CdivFxJfr7ja4q/nnvJ/MFaI2tCDVFmb+SzBFq5:3/+DJT71q/nKF92f+S3e
- TLSH
  T1EF6833DDA8F9A843C8BBEC7179C97D7D0283028C5ACFD104ED855FA51B19DC316868AE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  x/발냄새일지/낮잠성지/주말계획표/고양이밥그릇현황_20200421_511.pptx
- Size 5KB
- SHA256 0426ef1ff5383d4690712bc62684f5e60eaf02d5613ee9db5c67871a3e0dfc9f
- MD5 b9bd589205090dfad4eb4430bee10e81
- SHA1 5612716d9573700c477a57f7504b7e6010486bd3
- SHA512 5b57f6bc1286363fd9867a283123a905cce1ffcd621511ce1c6ce3ca80b29ac88c78c20f8bf2289f2b594ffe60163af1f8d461b68684612044b6ce510b35b05d
- SSDEEP 96:s0mLdwF0Vg1Phequr8DkGERaoczrgR6qsHqbf9qsyqbfsqsNqbfHqsgqb0D7eM3t:sNvV65TIMMRZczrgRXsH0f4sy0fJsN0q
- TLSH
  T1E3C19418A851102BC7A362769A34CF4408D7CF135A2BA30B5CEF235946CCDC35B223E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  x/발냄새일지/낮잠성지/주말계획표/배달비절약방안_20180611_957.pptx
- Size 3KB
- SHA256 1f0fe02b01198015e7e619c3a6f8f18daeb4ac181d3aa9e5516a130868eb62a8
- MD5 e90b6605a1cfe18bfbe817f294a3b9d9
- SHA1 d60d0e4b9b020efb3028094ab3dbb59367f8c20d
- SHA512 18cdb5729f8ce248d11e6b5b066b243de1e193590edaadb764c7d0bd343ccfd9bfb0d228411815f960036ab6e6e253d44375a6ac5ecbdf1889eb915aec5cccfa
- TLSH
  T17171A5188C90101ACBA3627BDA34DF4405C7CF07155AA30B6DEF5395458DED25F1A7EB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/FN_고양이_라면조리법검토_2023.pptx
- Size 6KB
- SHA256 ddf55714aa2fd182e3c7f8963eb6773f5fe017bf3c122a6357953142097d14fc
- MD5 4fdc5a1d7faae8b0002139e1c7b94873
- SHA1 6dd5cd0a237ad2653978f9850216bebe130f91e6
- SHA512 27437daed470450a93179227de88f098e1807684538d6d008ac4e1bbc72b8ead6bcaeecfdbf2de5b29b33ab3f9afcb30581f6d15586e397692234625c33aed3a
- SSDEEP 192:y9T/U9HrTIMMRZczrgRXsH0f4sy0fJsN0fKsg0fTsb0e9i/RRzy78oFQOamXHW/:y9kLTIvzcXgRXsHg4sygJsNgKsggTsbw
- TLSH
  T121D163189891241BC7A362B79A38DF4508CBCF475A27A7075DEF239946CCED24B123E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/FN_참외_낮잠시간계획안_2024.docx
- Size 1KB
- SHA256 1e46231ff63782b8b27916fd1b36661b8144cbc99c311056c99c64600d31b052
- MD5 7c16ba9aaedb88597e9795a6226aa16a
- SHA1 cbe4a07fb1c32ade08421d393635284cec64f367
- SHA512 2044460bcabe40d1f0b4332008d69a5bfa1f70d017033a2fc483154b3a115a6c8bd27c3cc5d0523e76e0ca880bd842b68bce5ff41a724ed3c1e6c0c1ecb5080a
- TLSH
  T1DC31B67599150214F28347B3E45ABD90DBECCC25B73C23476AAE37EC62422D19B8704A
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/JM_2024년_냉동식품재고_됩니까.pptx
- Size 4KB
- SHA256 2609624d240143f538a4d95399382191afe0b697e7cfaf77de4a8e786689c4e6
- MD5 23814f9c1a6527d742e88b4f0a3676df
- SHA1 d3ac55d964ec4df21e95e77bc7ad0d1b791609f7
- SHA512 af7438ed8ca501ebd374fcccc6ff9539a9843c0c6649e8e2ca920bf9af7f3128bb3325f6def54c3227d7c0f5c326bb5a3dbcda1ba89c334ea2b28a36b599b4c9
- SSDEEP 96:NwfA8hKAhequr8DkGERaoczrgR6qsHqbf9qsyqbfsqsNqbcE3LrM3+5Ri2z1gN7j:NY7hTIMMRZczrgRXsH0f4sy0fJsN0VBy
- TLSH
  T1D9A17114AC50101AC3A362BBDA34CB4518C6CF03466AA34B59EF23A506CCED25F123E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/LC_2015년_버스정류장대기록_같은거.pptx
- Size 4KB
- SHA256 2609624d240143f538a4d95399382191afe0b697e7cfaf77de4a8e786689c4e6
- MD5 23814f9c1a6527d742e88b4f0a3676df
- SHA1 d3ac55d964ec4df21e95e77bc7ad0d1b791609f7
- SHA512 af7438ed8ca501ebd374fcccc6ff9539a9843c0c6649e8e2ca920bf9af7f3128bb3325f6def54c3227d7c0f5c326bb5a3dbcda1ba89c334ea2b28a36b599b4c9
- SSDEEP 96:NwfA8hKAhequr8DkGERaoczrgR6qsHqbf9qsyqbfsqsNqbcE3LrM3+5Ri2z1gN7j:NY7hTIMMRZczrgRXsH0f4sy0fJsN0VBy
- TLSH
  T1D9A17114AC50101AC3A362BBDA34CB4518C6CF03466AA34B59EF23A506CCED25F123E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral13 behavioral14
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/LC_참외_냉장고재고현황_2017.xlsx
- Size 2KB
- SHA256 656cac4c90a10f6bcc34b362c7e24183f7e1f4e5f5c1892e4ad49c762d33e1db
- MD5 0d5685c8d6fcd281e7a9ec45d8fc2b68
- SHA1 28e2f58687db6fadd9a71be9c2c0c8e4e2fe67e7
- SHA512 bf0de8f7951af825bec32175cc75a2f6c258a1758ea3fb203327a1f6985a0c0748c964a3bb0c4a2fe8caf722821d1a5e96e7d407119fcb215cbc76d46367e07a
- TLSH
  T14841746D590A24A1D2CB6872A5691FC380D568E3430DF38F739D72AD61C72C08F5A9E6
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/YT_2019년_낮잠시간계획안_같은거.xlsx
- Size 1KB
- SHA256 79aaf120bdda4474dec6f507d7d4e7079c1fb52c73b38ecd4d8db574684f8dbb
- MD5 ca90136e8b5d09ca6fc8fb174c19e611
- SHA1 289cd6eca6044f19409827570269780c9adbc618
- SHA512 e9e18748e47e48670e289c8540be294a28f5c903f30e19815742a82c0f6c6900c876481cd8197f080954a5ba6d906a6ed3226477dd429ad9e7cbd067eb9cb460
- TLSH
  T18941B77F5A9824A1C3CB28326A2C1B42915699F3430DF387369C719816C32C15F7A5AF
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/ZB_2015년_간식예산집행서_아무거나.xlsx
- Size 2KB
- SHA256 656cac4c90a10f6bcc34b362c7e24183f7e1f4e5f5c1892e4ad49c762d33e1db
- MD5 0d5685c8d6fcd281e7a9ec45d8fc2b68
- SHA1 28e2f58687db6fadd9a71be9c2c0c8e4e2fe67e7
- SHA512 bf0de8f7951af825bec32175cc75a2f6c258a1758ea3fb203327a1f6985a0c0748c964a3bb0c4a2fe8caf722821d1a5e96e7d407119fcb215cbc76d46367e07a
- TLSH
  T14841746D590A24A1D2CB6872A5691FC380D568E3430DF38F739D72AD61C72C08F5A9E6
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/ZB_2020년_유튜브시청기록_같은거.pptx
- Size 5KB
- SHA256 0426ef1ff5383d4690712bc62684f5e60eaf02d5613ee9db5c67871a3e0dfc9f
- MD5 b9bd589205090dfad4eb4430bee10e81
- SHA1 5612716d9573700c477a57f7504b7e6010486bd3
- SHA512 5b57f6bc1286363fd9867a283123a905cce1ffcd621511ce1c6ce3ca80b29ac88c78c20f8bf2289f2b594ffe60163af1f8d461b68684612044b6ce510b35b05d
- SSDEEP 96:s0mLdwF0Vg1Phequr8DkGERaoczrgR6qsHqbf9qsyqbfsqsNqbfHqsgqb0D7eM3t:sNvV65TIMMRZczrgRXsH0f4sy0fJsN0q
- TLSH
  T1E3C19418A851102BC7A362769A34CF4408D7CF135A2BA30B5CEF235946CCDC35B223E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/감자_졸음주의안내문_2022-11-14.docx
- Size 1KB
- SHA256 bce59db8585a866f31562c1be23bd2f40286d08f91959f1ea7b1f0e61f703905
- MD5 1ab648ae9e562ea9726bb85c3528c34e
- SHA1 c2f45fc75b1b90db3db9a6cc356d716a1d45c6cc
- SHA512 0615568c4e2d2438a6deb65ac463b68d19c04c73190dcc9139fa5fd483e12ec296dc128732f865a226413553d75565f562f2d7a7f5eefd2ebd2b3ca1e224c63b
- TLSH
  T12231527EAA090210E741A373F4252F845EE88C1AB92DE243686F37CA25C22D15B1358D
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/고양이수면보고_20180708_341.xlsx
- Size 1KB
- SHA256 a477314e09ceb417851be30765e13c3d56f0361d16e7e5e1b480fa8c2d0d3096
- MD5 c3521417bc19132280063f73b84839fb
- SHA1 94301edd25017cf2669df3c56fe25b84fae5b547
- SHA512 7588efd87c703905d591b8370ffd2e23c14a4bac5f64b09fdc72e913f490706bb7752841a00d7edeab69f9f84b4ba16011f8ebb0488f8a451ecfec4c89d40726
- TLSH
  T1FA31B7AFEA4540A2D3D9653395191F93E25868275B0EE34772FD372835C23C05E0A4EC
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/낮잠시간계획안_20230413_721.pptx
- Size 5KB
- SHA256 0426ef1ff5383d4690712bc62684f5e60eaf02d5613ee9db5c67871a3e0dfc9f
- MD5 b9bd589205090dfad4eb4430bee10e81
- SHA1 5612716d9573700c477a57f7504b7e6010486bd3
- SHA512 5b57f6bc1286363fd9867a283123a905cce1ffcd621511ce1c6ce3ca80b29ac88c78c20f8bf2289f2b594ffe60163af1f8d461b68684612044b6ce510b35b05d
- SSDEEP 96:s0mLdwF0Vg1Phequr8DkGERaoczrgR6qsHqbf9qsyqbfsqsNqbfHqsgqb0D7eM3t:sNvV65TIMMRZczrgRXsH0f4sy0fJsN0q
- TLSH
  T1E3C19418A851102BC7A362769A34CF4408D7CF135A2BA30B5CEF235946CCDC35B223E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/냉동식품재고_20210221_381.docx
- Size 1KB
- SHA256 7f8338565e213b6fa8ff3acc16a91fad47db079c05044d849cf4a8b51e51e74f
- MD5 091c47a3e2a491ca47137c2a36f2b5f1
- SHA1 4e40dbdb3b5b4de5bd2c25c44a05b3b77a9e1810
- SHA512 8ec7252ffcefcd0011ae82894a85758718147804ff5eb96954b07ff58ef0c46b63707d2821857272bff92e570e0c6d566fdc34a4b5900a4f95f1887a0085d000
- TLSH
  T19A31B6399C0B4058D3C39237D4043AC49FDCDA06F66E5347656E3BD941877CD0BA7409
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral29 behavioral30
- Target
  x/발냄새일지/낮잠성지/주말계획표/산책경로/두부_고양이수면보고_2023-11-25.pptx
- Size 6KB
- SHA256 ddf55714aa2fd182e3c7f8963eb6773f5fe017bf3c122a6357953142097d14fc
- MD5 4fdc5a1d7faae8b0002139e1c7b94873
- SHA1 6dd5cd0a237ad2653978f9850216bebe130f91e6
- SHA512 27437daed470450a93179227de88f098e1807684538d6d008ac4e1bbc72b8ead6bcaeecfdbf2de5b29b33ab3f9afcb30581f6d15586e397692234625c33aed3a
- SSDEEP 192:y9T/U9HrTIMMRZczrgRXsH0f4sy0fJsN0fKsg0fTsb0e9i/RRzy78oFQOamXHW/:y9kLTIvzcXgRXsHg4sygJsNgKsggTsbw
- TLSH
  T121D163189891241BC7A362B79A38DF4508CBCF475A27A7075DEF239946CCED24B123E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32