Overview

overview

10

Static

static

7

Creative_C...Up.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Creative_Cloud_Set-Up.exe

  • Size

    2.8MB

  • Sample

    230527-tw4wkach2z

  • MD5

    e522f8b8c4a3ce819467aac70121ea82

  • SHA1

    17847911f9a47f099657a19dca3e561047bb767c

  • SHA256

    c083e94b1a06a934e1d0232e8d990d61bfffcd0037f934168418be6a4480de99

  • SHA512

    a2ad329bb0ab6e49f81b1920b79c6602a9e21e7ac9846eac1c097d850eb2c07c63f994153c679bc8efd76b47d006428ef3c11e48b1467438a53cf2f580b320e7

  • SSDEEP

    49152:k51Z7F25DNGy3g9lRC8mk62yFjqGAuf75pqjf8jJPfs/kfwMflf0hchZgtyP4:k515F2W+8ClgduD59fVfwM/aw4

Score
10/10
bazarloaderadobediscoverydropperloaderpersistencephishingupx

Malware Config

Targets

    • Target

      Creative_Cloud_Set-Up.exe

    • Size

      2.8MB

    • MD5

      e522f8b8c4a3ce819467aac70121ea82

    • SHA1

      17847911f9a47f099657a19dca3e561047bb767c

    • SHA256

      c083e94b1a06a934e1d0232e8d990d61bfffcd0037f934168418be6a4480de99

    • SHA512

      a2ad329bb0ab6e49f81b1920b79c6602a9e21e7ac9846eac1c097d850eb2c07c63f994153c679bc8efd76b47d006428ef3c11e48b1467438a53cf2f580b320e7

    • SSDEEP

      49152:k51Z7F25DNGy3g9lRC8mk62yFjqGAuf75pqjf8jJPfs/kfwMflf0hchZgtyP4:k515F2W+8ClgduD59fVfwM/aw4

    Score
    10/10
    bazarloaderadobediscoverydropperloaderpersistencephishingupx

    • Bazar Loader

      Detected loader normally used to deploy BazarBackdoor malware.

      loaderdropperbazarloader

    • Detected adobe phishing page

      phishingadobe

    • Bazar/Team9 Loader payload

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3
T1060

Privilege Escalation

Defense Evasion

Modify Registry

5
T1112

File Permissions Modification

1
T1222

Install Root Certificate

1
T1130

Credential Access

Discovery

Query Registry

7
T1012

System Information Discovery

6
T1082

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks