Overview

overview

8

Static

static

1

SkinPack W...rk.exe

windows7-x64

8

SkinPack W...rk.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SkinPack Windows 20 Dark.exe

  • Size

    2.0MB

  • Sample

    230225-jdgyzace68

  • MD5

    eedfe368a0d99e78a391fd0213b12b28

  • SHA1

    20dae91ccad345974938bee716d7d1c246aa7196

  • SHA256

    af0f888b2fcf970a0d35292d612532902b968e7b789b09fefcf689e4d77cb059

  • SHA512

    0eb6415a75ebd05e6610583ec57b644b0bde9595979b2f911a8bd3ce4f359d0e6828c699d56c426e0a86a8d1cfca2ec6d454518fdbc96be8402513a31c449a30

  • SSDEEP

    49152:csmHsiqbEA2jg1MeJJVWaxLvVp2ff3hJFkylTeOdI1/5nnib+wx3:H8q4A2EaY1xpp2Hh8ylaga/pw+wx3

Score
8/10
adwarediscoveryexploitpersistencestealerupx

Malware Config

Targets

    • Target

      SkinPack Windows 20 Dark.exe

    • Size

      2.0MB

    • MD5

      eedfe368a0d99e78a391fd0213b12b28

    • SHA1

      20dae91ccad345974938bee716d7d1c246aa7196

    • SHA256

      af0f888b2fcf970a0d35292d612532902b968e7b789b09fefcf689e4d77cb059

    • SHA512

      0eb6415a75ebd05e6610583ec57b644b0bde9595979b2f911a8bd3ce4f359d0e6828c699d56c426e0a86a8d1cfca2ec6d454518fdbc96be8402513a31c449a30

    • SSDEEP

      49152:csmHsiqbEA2jg1MeJJVWaxLvVp2ff3hJFkylTeOdI1/5nnib+wx3:H8q4A2EaY1xpp2Hh8ylaga/pw+wx3

    Score
    8/10
    adwarediscoveryexploitpersistencestealerupx

    • Possible privilege escalation attempt

      exploit

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

File Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks