General

  • Target

    360TS_Setup_11.0.0.1042.exe

  • Size

    90.3MB

  • Sample

    240321-1w96xade4t

  • MD5

    a8b8ed2d4374ee6eb6eee5936c05691a

  • SHA1

    79de34161378dcbe8fe1464c12d87d0f722e47ed

  • SHA256

    5f3de6fe5afe60fc06a0407f8e01aef854128945a0e1502f1e14544592174d9a

  • SHA512

    87d75afcd9bb5b25c1920c2ea7160b79d0fc699e8cdbf91b28513bc69d7308d088433cc5c53849e29689c37e3fa7f3118a95753b540898bfa1c7c6762ba0362f

  • SSDEEP

    1572864:3ZSDrj8wmrD75PxriTEMr3BRICPl6A0SCFPS+n8JT:+v8br/5IEu3BRICgA0SP+n8JT

Malware Config

Targets

    • Target

      360TS_Setup_11.0.0.1042.exe

    • Size

      90.3MB

    • MD5

      a8b8ed2d4374ee6eb6eee5936c05691a

    • SHA1

      79de34161378dcbe8fe1464c12d87d0f722e47ed

    • SHA256

      5f3de6fe5afe60fc06a0407f8e01aef854128945a0e1502f1e14544592174d9a

    • SHA512

      87d75afcd9bb5b25c1920c2ea7160b79d0fc699e8cdbf91b28513bc69d7308d088433cc5c53849e29689c37e3fa7f3118a95753b540898bfa1c7c6762ba0362f

    • SSDEEP

      1572864:3ZSDrj8wmrD75PxriTEMr3BRICPl6A0SCFPS+n8JT:+v8br/5IEu3BRICgA0SP+n8JT

    • Modifies boot configuration data using bcdedit

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Modifies Installed Components in the registry

    • Sets service image path in registry

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Checks for any installed AV software in registry

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Checks whether UAC is enabled

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks