Overview

overview

10

Static

static

3

MW2 Unlock...or.exe

windows7-x64

10

MW2 Unlock...or.exe

windows10-2004-x64

10

MW2 Unlock...ll.dll

windows7-x64

1

MW2 Unlock...ll.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WZ2 & MW2 Unlock Tool.rar

  • Size

    10.6MB

  • Sample

    230723-rraqtaec87

  • MD5

    af4914f50906b74db937aa623db9db07

  • SHA1

    3fd804935603fb32a3c16f344d9dfd2ee963a0b4

  • SHA256

    478ad1180674de090d241969f6ea4226f59df44f0cc5a7b59bdb558fff89804f

  • SHA512

    065faa59be35711bd8d494a2471ce242393cea094aed907a12575b56b0a58c07f18e0818783618d5018be76511e629d89c159ca7281540a47bd32359ebac4737

  • SSDEEP

    196608:i8wLN078GPEYN53B9Ubqw1wP+VAe6Cbhgp3EkKWykeALN9aGMjwheIGqaUN9JA8i:i8ON0wyR9QqjmVAIbhc3Hvy2na3jwoIU

Score
10/10
evasionpersistencespywarestealer

Malware Config

Targets

    • Target

      MW2 Unlock Tool/WZ_Injector.exe

    • Size

      10.5MB

    • MD5

      a18b7ec8cfeaa7d039669fc7d615ba78

    • SHA1

      1dd09f2bfa3af12910e196d51a2126dbe410c5c7

    • SHA256

      cca6425de79c06b99206a159be26bd7dfb4fa855962b38c4c23d110a6ef8921c

    • SHA512

      c672f887886b1dfff164486197e9060abdfa2bccf9b581a2d888cc4394679a1fd125014a70fe801ad5e53baff9d1071e8495593585ad101fb3115485086bb62f

    • SSDEEP

      196608:8Ss0yoEQgWM3cUl1yxSACn1wxHiRw+CJux32gYaSJj143k0Kq5ouF14bvAwqGvS6:PyoEQg5tl1yxSi+wDJu3tRAGk0v5/boZ

    Score
    10/10
    evasionpersistencespywarestealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Sets service image path in registry

      persistence

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

    • Target

      MW2 Unlock Tool/unlock_all.dll

    • Size

      124KB

    • MD5

      1340fa26deb8aea61c246432ec38cefe

    • SHA1

      a026c3c884791e670a2c6fa11ed8cd867edea502

    • SHA256

      cce3a5350ae22aad98998212abc0aab381a0b64f329ee9fc7ad62625f1bf93ef

    • SHA512

      fdbfd13ee1200df37d27dddebb6a613f93e30d511695f45ecea2a08afabaa34979b1fed99e1d440a812e9276557fad9d5d3ff48e1e0ae7f9b5442109afd7499e

    • SSDEEP

      1536:mldfDBMIkhTIgzjZVRv1CO4M0YN3yYS1mTSMtMqJ0qsjZdzRKsWsQdf9dlvp2OA2:mldLSxd1H0AyzgTVtnuqodUfhp2Ob

    Score
    3/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks