Overview

overview

8

Static

static

1

DropboxInstaller.exe

windows10-2004-x64

8

Resubmissions

01/03/2023, 22:38

230301-2ks9paae34 8

01/03/2023, 22:31

230301-2fnteaae23 8

Sharing

Copy URL Twitter E-mail

General

  • Target

    DropboxInstaller.exe

  • Size

    654KB

  • Sample

    230301-2ks9paae34

  • MD5

    c403886af85de9303dc45ed788a975a1

  • SHA1

    bca60540c6f95debbaff0cf962ab04115abac9d3

  • SHA256

    20d28e00ee6a6d8fb3c77139057b7c82c96d652c35a555bf6553dffae46b46f2

  • SHA512

    1543cac91a7dc17e58034c6dc0638a8f14ef8f973fd64836b6e600e314d1dc1eb70036717fe7a5ad6a6f2542134a2bc8c8c39efea8d51a1e1c69f54d6d308b7a

  • SSDEEP

    12288:l/iSuK1HP6mu7kpApkp+PcJml7J+jEbT3hyUriQxB+Mu33nYF4P08jxwqwoTY1V:l/i21v6mu7kDpaBIW/r123IiP9YCYv

Score
8/10
discoveryevasionpersistencetrojan

Malware Config

Targets

    • Target

      DropboxInstaller.exe

    • Size

      654KB

    • MD5

      c403886af85de9303dc45ed788a975a1

    • SHA1

      bca60540c6f95debbaff0cf962ab04115abac9d3

    • SHA256

      20d28e00ee6a6d8fb3c77139057b7c82c96d652c35a555bf6553dffae46b46f2

    • SHA512

      1543cac91a7dc17e58034c6dc0638a8f14ef8f973fd64836b6e600e314d1dc1eb70036717fe7a5ad6a6f2542134a2bc8c8c39efea8d51a1e1c69f54d6d308b7a

    • SSDEEP

      12288:l/iSuK1HP6mu7kpApkp+PcJml7J+jEbT3hyUriQxB+Mu33nYF4P08jxwqwoTY1V:l/i21v6mu7kDpaBIW/r123IiP9YCYv

    Score
    8/10
    discoveryevasionpersistencetrojan

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks