Resubmissions

25-11-2022 12:22

221125-pkckqagb82 10

25-11-2022 12:07

221125-palqmsfe29 8

General

  • Target

    5ccaf1.msi

  • Size

    188.9MB

  • Sample

    221125-pkckqagb82

  • MD5

    d370c807da44914b07440bb5c5eb554b

  • SHA1

    a1106253372c94baaa343f6d3a0b63628a5a0a6c

  • SHA256

    eb8484e9698f21d049c90750bdc1eec37c3f899c0ddd6e73ccf42e17edab0107

  • SHA512

    9b252ff1e945b2cfa44e462a4ed73e17b6809733202cad5c321dcd09ee32301f1a8a5be0362fd795b40d36380de663b855847bc65cc220220e5360d3cf2c531d

  • SSDEEP

    3145728:B8eWmtYoa0bEut/C6LOJCIx7p0pQMyAC5kndaZcee3iaASySuiNfX1XlL:BlTtYBcEs3KCIx7qWMjTeEOSyJiv

Score
10/10

Malware Config

Extracted

Path

C:\Program Files\Wizards of the Coast\MTGA\MTGA_Data\Plugins\ThirdPartyNotices.txt

Ransom Note
This production is brought to you, in part, by the following libraries. Most of the libraries listed below are parts of the Chromium web browser, embedded using CEF: https://www.chromium.org/Home https://bitbucket.org/chromiumembedded/cef The files that primarily contain code from Chromium are the zf_cef.dll/so (normally named libcef.dll/so) and "Chromium Embedded Framework" shared libraries. Note that some of the libraries listed below are only used as tools during building and development and are not included with this product. Check the Chromium source code for details. ----------------------------------------------------------------------- OpenVR C# Bindings 1.0.10 https://github.com/ValveSoftware/openvr/blob/master/headers/openvr_api.cs ----------------------------------------------------------------------- Copyright (c) 2015, Valve Corporation All rights reserved. --- See BSD License (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- SimpleJson.cs https://github.com/facebook-csharp-sdk/simple-json ----------------------------------------------------------------------- Copyright (c) 2011, The Outercurve Foundation, 2015 Zen Fulcrum LLC Licensed under the MIT License (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.opensource.org/licenses/mit-license.php Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Nathan Totten (ntotten.com), Jim Zimmerman (jimzimmerman.com), Prabir Shrestha (prabir.me), Jonathan Stephens ----------------------------------------------------------------------- ----------------------------------------------------------------------- C-Sharp-Promise https://github.com/Real-Serious-Games/C-Sharp-Promise ----------------------------------------------------------------------- The MIT License (MIT) Copyright (c) 2014 Real Serious Games --- See MIT License at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- libX11 https://www.x.org/wiki/ ----------------------------------------------------------------------- Copyright © 1985, 1986, 1987, 1988, 1989, 1991, 1994, 1996, 2002 The Open Group Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the “Software”), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED “AS IS”, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE OPEN GROUP BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. Except as contained in this notice, the name of The Open Group shall not be used in advertising or otherwise to promote the sale, use or other dealings in this Software without prior written authorization from The Open Group. Copyright © 1985, 1986, 1987, 1988, 1989, 1991 Digital Equipment Corporation Permission to use, copy, modify and distribute this documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appears in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the names of Digital and Tetronix not be used in in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Digital and Tetronix make no representations about the suitability of the software described herein for any purpose. It is provided “as is” without express or implied warranty. TekHVC is a trademark of Tektronix, Inc. ----------------------------------------------------------------------- ----------------------------------------------------------------------- Chromium Embedded Framework https://bitbucket.org/chromiumembedded/cef/ ----------------------------------------------------------------------- Copyright (c) 2008-2014 Marshall A. Greenblatt. Portions Copyright (c) 2006-2009 Google Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. * Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. * Neither the name of Google Inc. nor the name Chromium Embedded Framework nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- (Components of) Bazel https://github.com/bazelbuild/bazel ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- AXE-CORE Accessibility Audit https://github.com/dequelabs/axe-core/ ----------------------------------------------------------------------- --- See Mozilla Public License (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Accessibility Audit library, from Accessibility Developer Tools https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Alliance for Open Media Video Codec https://aomedia.googlesource.com/aom/ ----------------------------------------------------------------------- Copyright (c) 2016, Alliance for Open Media. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- Almost Native Graphics Layer Engine http://code.google.com/p/angleproject/ ----------------------------------------------------------------------- // Copyright (C) 2002-2013 The ANGLE Project Authors. // All rights reserved. // // Redistribution and use in source and binary forms, with or without // modification, are permitted provided that the following conditions // are met: // // Redistributions of source code must retain the above copyright // notice, this list of conditions and the following disclaimer. // // Redistributions in binary form must reproduce the above // copyright notice, this list of conditions and the following // disclaimer in the documentation and/or other materials provided // with the distribution. // // Neither the name of TransGaming Inc., Google Inc., 3DLabs Inc. // Ltd., nor the names of their contributors may be used to endorse // or promote products derived from this software without specific // prior written permission. // // THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS // "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT // LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS // FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE // COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, // INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, // BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; // LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER // CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT // LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN // ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE // POSSIBILITY OF SUCH DAMAGE. ----------------------------------------------------------------------- ----------------------------------------------------------------------- American Fuzzy Lop http://lcamtuf.coredump.cx/afl/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android http://source.android.com/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android Crazy Linker https://chromium.googlesource.com/chromium/src.git/+/master/third_party/android_crazy_linker/ ----------------------------------------------------------------------- // Copyright 2014 The Chromium Authors. All rights reserved. // // --- See BSD License (Google) at the end of this file --- Copyright (C) 2012 The Android Open Source Project * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in * the documentation and/or other materials provided with the * distribution. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android Explicit Synchronization http://source.android.com/ ----------------------------------------------------------------------- --- See Apache License (A) at the end of this file --- --- See Apache License Appendix (A) at the end of this file --- ----------------------------------------------------------------------- ----------------------------------------------------------------------- Android FloatProperty https://developer.android.com/reference/android/util/FloatProperty.html ----------------------------------------------------------------------- Copyright (c) 2005-2008, The Android Open Source Project Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --- See Apache License (A) at the end of this file --- APPENDIX: How to apply the Apache License to your work. To apply the Apache License to your work, attach the following boilerplate notice, with the fields enclosed by brackets "[]" replaced with your own identifying information. (Don't include the brackets!) The text should be enclosed in the appropriate comment syntax for the file format. We also recommend that a file or class name and description of purpose be included on the same "printed page" as the copyright notice for easier identification within third-party archives. Copyright 2011 Google Inc. All Rights Reserved. Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License
Emails

[email protected]

<[email protected]>

[email protected]

[email protected]

[email protected]

[email protected]

<[email protected]>

[email protected]

[email protected]

<[email protected]>

[email protected]

[email protected]

[email protected]

[email protected])"

[email protected])"

[email protected]

<[email protected]>

<[email protected]>

<[email protected]>

<[email protected]>

URLs

https://www.chromium.org/Home

https://bitbucket.org/chromiumembedded/cef

https://github.com/ValveSoftware/openvr/blob/master/headers/openvr_api.cs

https://github.com/facebook-csharp-sdk/simple-json

http://www.opensource.org/licenses/mit-license.php

https://github.com/Real-Serious-Games/C-Sharp-Promise

https://www.x.org/wiki/

https://bitbucket.org/chromiumembedded/cef/

https://github.com/bazelbuild/bazel

https://github.com/dequelabs/axe-core/

https://raw.githubusercontent.com/GoogleChrome/accessibility-developer-tools/master/dist/js/axs_testing.js

https://aomedia.googlesource.com/aom/

http://code.google.com/p/angleproject/

http://lcamtuf.coredump.cx/afl/

http://source.android.com/

https://chromium.googlesource.com/chromium/src.git/+/master/third_party/android_crazy_linker/

https://developer.android.com/reference/android/util/FloatProperty.html

http://www.apache.org/licenses/LICENSE-2.0

https://android.googlesource.com/platform/frameworks/support

https://android.googlesource.com/platform/packages/apps/Settings/

Targets

    • Target

      5ccaf1.msi

    • Size

      188.9MB

    • MD5

      d370c807da44914b07440bb5c5eb554b

    • SHA1

      a1106253372c94baaa343f6d3a0b63628a5a0a6c

    • SHA256

      eb8484e9698f21d049c90750bdc1eec37c3f899c0ddd6e73ccf42e17edab0107

    • SHA512

      9b252ff1e945b2cfa44e462a4ed73e17b6809733202cad5c321dcd09ee32301f1a8a5be0362fd795b40d36380de663b855847bc65cc220220e5360d3cf2c531d

    • SSDEEP

      3145728:B8eWmtYoa0bEut/C6LOJCIx7p0pQMyAC5kndaZcee3iaASySuiNfX1XlL:BlTtYBcEs3KCIx7qWMjTeEOSyJiv

    Score
    10/10
    • Blocklisted process makes network request

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks