Overview

overview

9

Static

static

3

Revi-PB-26.10.7z

windows10-2004-x64

1

Configurat...rt.ps1

windows10-2004-x64

3

Configurat...in.yml

windows10-2004-x64

3

Executable...rences

windows10-2004-x64

3

Executable...ER.ps1

windows10-2004-x64

7

Executable...ES.ps1

windows10-2004-x64

7

Executable...ts.xml

windows10-2004-x64

3

Executables/EDGE.ps1

windows10-2004-x64

3

Executable...OC.cmd

windows10-2004-x64

5

Executable...ZE.cmd

windows10-2004-x64

9

Executable...n.json

windows10-2004-x64

3

Executable...on.xml

windows10-2004-x64

3

Executable...pl.txt

windows10-2004-x64

1

Executable....0.txt

windows10-2004-x64

1

Executable...ns.xml

windows10-2004-x64

3

Executables/ONED.cmd

windows10-2004-x64

7

Executable...up.exe

windows10-2004-x64

8

Executable...NU.cmd

windows10-2004-x64

3

Executable...me.ps1

windows10-2004-x64

6

Executable...PX.ps1

windows10-2004-x64

3

Executable...ER.ps1

windows10-2004-x64

3

Executable...up.cmd

windows10-2004-x64

6

Executable...op.jpg

windows10-2004-x64

1

Executable...en.jpg

windows10-2004-x64

1

Executables/assoc.ps1

windows10-2004-x64

3

Executables/hosts

windows10-2004-x64

3

Executables/ngen.ps1

windows10-2004-x64

7

Executable...s.json

windows10-2004-x64

3

Images/brave.png

windows10-2004-x64

1

Images/firefox.png

windows10-2004-x64

1

playbook.xml

windows10-2004-x64

3

playbook.png

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Revi-PB-26.10.apbx
  • Size 32.1MB
  • Sample261107-m5srbsbs51
  • SHA256 7698b591b0b2d46bc99b3ffe9dbd7ec560a3fbee3ec8dee2731caead5546c74a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryevasionexecutioninstallerpersistenceprivilege_escalationransomwarespyware

Malware Config

Targets

    • Target
      Revi-PB-26.10.apbx
    • Size 32.1MB
    • SHA256 7698b591b0b2d46bc99b3ffe9dbd7ec560a3fbee3ec8dee2731caead5546c74a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1
    • Target
      Configuration/Tasks/start.yml
    • Size 2KB
    • SHA256 3f886f7b4d84c54d84f3a609d250bfadedb537048b56604b7c82f4614423c104
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral2
    • Target
      Configuration/main.yml
    • Size 1KB
    • SHA256 e52e5fc818007c48f5f3aa6fb8e6f061048077aca0e3d9f549dcdbe8765c8b4b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral3
    • Target
      Executables/BraveSoftware/Brave-Browser/Application/initial_preferences
    • Size 842B
    • SHA256 48fc7bc0ab76a720ac88dea8d8ea4b1ba0da84f1163926b6261d0306981c59d5
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral4
    • Target
      Executables/CLEANER.ps1
    • Size 3KB
    • SHA256 842c36ce018556c0a8771eda14346017545a0963334e308221e1dfcd0578c666
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    defense_evasiondiscoveryexecutionpersistenceransomware

    • Deletes itself

      defense_evasion

    • Executes dropped EXE

    • Indicator Removal: Clear Windows Event Logs

      Clear Windows Event Logs to hide the activity of an intrusion.

      defense_evasion

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral5
    • Target
      Executables/DISM-FEATURES.ps1
    • Size 1KB
    • SHA256 501ff13c046f00523e37915a753d150f29a7bf56533f84c647111eefc1bb0f77
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    discoveryexecutionpersistenceransomware

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral6
    • Target
      Executables/DefaultLayouts.xml
    • Size 37KB
    • SHA256 66d8ca9b63766dadf15cae55a518d1f3ae6e206252c8eb6853c7904126ae6c34
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral7
    • Target
      Executables/EDGE.ps1
    • Size 5KB
    • SHA256 c2827138e887e35f87a74e7e5c1d73b1658e5e6999bbd765875e5cccce0a5612
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral8
    • Target
      Executables/FILEASSOC.cmd
    • Size 1KB
    • SHA256 fb05332934a26fbffd3c49945d0c85469313a13429e558d6f2482ba318cdd9f4
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Drops file in System32 directory

    behavioral9
    • Target
      Executables/FINALIZE.cmd
    • Size 4KB
    • SHA256 76ecaaa401c1bc2545537e42b2175fe09ed60a42f76295f1e267ec1ac18dfd75
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    discoveryevasionexecutionpersistenceprivilege_escalationransomware

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery
    behavioral10
    • Target
      Executables/LayoutModification.json
    • Size 456B
    • SHA256 09c74100dda6bdf41c9e56e639494e851913b20221710c679e52dc61884f1f25
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral11
    • Target
      Executables/LayoutModification.xml
    • Size 503B
    • SHA256 ff31644f1a05c40f4b05e059ce4ceeb6716fcb00cffb8612153c5eaba44bab4c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral12
    • Target
      Executables/Licenses/brave-browser-mpl.txt
    • Size 16KB
    • SHA256 9221c2f936159b8446d329249fb4c0f25be510f447383a0f13336ac7985668a3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13
    • Target
      Executables/Licenses/fluent-gtk-theme-gnu-gpl-v3.0.txt
    • Size 34KB
    • SHA256 0b383d5a63da644f628d99c33976ea6487ed89aaa59f0b3257992deac1171e6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral14
    • Target
      Executables/OEMDefaultAssociations.xml
    • Size 1KB
    • SHA256 db83958385370a11ac5f7176e1a527494cb9e8cd8172290f88646e0670ddbbef
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral15
    • Target
      Executables/ONED.cmd
    • Size 2KB
    • SHA256 88785e0fbe4a57597f0e47d341c9a347b81a3ce0b5dcf80d42b4b62171bffe30
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    discoveryexecutionpersistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral16
    • Target
      Executables/RevisionTool-Setup.exe
    • Size 31.6MB
    • SHA256 776d79a087705cd1125f675321e5e08996c7a1d6bcd44eed2c6b217d0e941bda
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutioninstallerpersistenceransomware

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery

    • Drops file in System32 directory

    behavioral17
    • Target
      Executables/STARTMENU.cmd
    • Size 5KB
    • SHA256 7d4df1bf006142f694b610b2f044e0b6026b880226743467e4940ae205b560bc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      Executables/Set-Theme.ps1
    • Size 3KB
    • SHA256 80da512f8286178024302ec3599440ec67ce273b9e9a266da01698631ed12dba
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral19
    • Target
      Executables/UPDATE-APPX.ps1
    • Size 823B
    • SHA256 15199558170e20bc7f13e07164827df89b775188fc06d7512db1db3a32c0efd8
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral20
    • Target
      Executables/WALLPAPER.ps1
    • Size 3KB
    • SHA256 d9fc7a0990de7da7e3d67d15dd2c45b4b25dbd75ced1a09cdc868962e73cf7c7
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21
    • Target
      Executables/WallpaperStartup.cmd
    • Size 668B
    • SHA256 373ef8d4b222a60420ac2421bbaf09e446d1ed87c6b34ca66db201e8b85d8700
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral22
    • Target
      Executables/Wallpapers/desktop.jpg
    • Size 727KB
    • SHA256 8fcd4b7579272acafe356b4d77a102fad7858ede7366387ff5c476cff6f343c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      Executables/Wallpapers/lockscreen.jpg
    • Size 506KB
    • SHA256 5f18c87762b59c47d03c33da84b370214553d3ff49f4cb261804da07c431683c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      Executables/assoc.ps1
    • Size 3KB
    • SHA256 1fe45f787b317127343ea054d2d7d01bcca3d43b724be74de70a79fbac9c7838
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral25
    • Target
      Executables/hosts
    • Size 3KB
    • SHA256 90090978c270e5fa5ee417145af36d6665b036f963f40da5c5989ab8dbef3d04
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral26
    • Target
      Executables/ngen.ps1
    • Size 499B
    • SHA256 c10541b184fa618d4014ec30635ba74debb5590636e41fb5ad64b15cc1ed9fe4
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    execution

    • Loads dropped DLL

    behavioral27
    • Target
      Executables/settings.json
    • Size 262B
    • SHA256 bb34432adcd852b499d58bc2d39984b24ffd68790feb86200af5b64642b9dec0
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral28
    • Target
      Images/brave.png
    • Size 4KB
    • SHA256 ae73d959bb520806a50eafd0bbb4d194b95bafcbed296b221c875251f341792f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29
    • Target
      Images/firefox.png
    • Size 6KB
    • SHA256 67d117274f593dadbdfff15469e6b8cf43e542855284ce25dfa2415185ef73df
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral30
    • Target
      playbook.conf
    • Size 8KB
    • SHA256 acfb2992b246dd03f438def31ecb2dd1751c11986c47710dd7ca3d8716075476
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral31
    • Target
      playbook.png
    • Size 56KB
    • SHA256 b1a7beeecb524fe54da9c86a9b3aaaf0d86f8feddd41583a1b9a244a9ce60338
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

4
T1059

PowerShell

3
T1059.001

Windows Command Shell

1
T1059.003

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Indicator Removal

2
T1070

Clear Windows Event Logs

1
T1070.001

File Deletion

1
T1070.004

Modify Registry

4
T1112

Credential Access

Discovery

Password Policy Discovery

1
T1201

Peripheral Device Discovery

2
T1120

Process Discovery

1
T1057

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Tasks

static1

installer
Score
3/10

behavioral1

Score
1/10

behavioral2

execution
Score
3/10

behavioral3

execution
Score
3/10

behavioral4

execution
Score
3/10

behavioral5

defense_evasiondiscoveryexecutionpersistenceransomware
Score
7/10

behavioral6

discoveryexecutionpersistenceransomware
Score
7/10

behavioral7

adwarediscoveryspyware
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
5/10

behavioral10

discoveryevasionexecutionpersistenceprivilege_escalationransomware
Score
9/10

behavioral11

execution
Score
3/10

behavioral12

adwarediscoveryspyware
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

adwarediscoveryspyware
Score
3/10

behavioral16

discoveryexecutionpersistenceprivilege_escalation
Score
7/10

behavioral17

discoveryexecutioninstallerpersistenceransomware
Score
8/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
6/10

behavioral20

execution
Score
3/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
6/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

execution
Score
7/10

behavioral28

execution
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

adwarediscoveryspyware
Score
3/10

behavioral32

Score
1/10