Overview

overview

8

Static

static

7

Microsoft ....exe

windows7-x64

7

Microsoft ....exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Microsoft Edge专用卸载工具.exe

  • Size

    978KB

  • Sample

    230307-qskfzaab52

  • MD5

    ed7bd3db9053fff31b3f900df45653f6

  • SHA1

    2eff63c95bbf03c7a1a96a68060be8b08b9c556d

  • SHA256

    91637011c4baf5302b12d9d41a2ebe9b38a7b29d9b71b87da654c978fb6d2ba8

  • SHA512

    202a627e9fd984bfc36379760267e734a2f909db0f6523eada68bef04dc71c5621861b8257201ee3be5daf12be7d0b65af29fac81fed7f58f0849cb77e655faf

  • SSDEEP

    24576:j4GHnhIzOT3OACh5lxubchdNN9N4lPn1tO:8shdT3shPxubcnLL

Score
8/10
adwarepersistencestealerupx

Malware Config

Targets

    • Target

      Microsoft Edge专用卸载工具.exe

    • Size

      978KB

    • MD5

      ed7bd3db9053fff31b3f900df45653f6

    • SHA1

      2eff63c95bbf03c7a1a96a68060be8b08b9c556d

    • SHA256

      91637011c4baf5302b12d9d41a2ebe9b38a7b29d9b71b87da654c978fb6d2ba8

    • SHA512

      202a627e9fd984bfc36379760267e734a2f909db0f6523eada68bef04dc71c5621861b8257201ee3be5daf12be7d0b65af29fac81fed7f58f0849cb77e655faf

    • SSDEEP

      24576:j4GHnhIzOT3OACh5lxubchdNN9N4lPn1tO:8shdT3shPxubcnLL

    Score
    8/10
    upxadwarepersistencestealer

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

4
T1060

Browser Extensions

1
T1176

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

3
T1012

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks