Overview

overview

7

Static

static

3

OpenShellS...91.exe

windows11-21h2-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OpenShellSetup_4_4_191.exe

  • Size

    7.9MB

  • Sample

    240422-p9xbesbh2z

  • MD5

    e0484fd1e79a0227a5923cdc95b511ba

  • SHA1

    bea0cb5c42adbde14e8cf50b64982e1877c7855d

  • SHA256

    9e9c32badb52444ca8a8726aef7c220ff48de8c7916cdfdca4dff6e009ac1f0c

  • SHA512

    80f8b0ac16dfbf7df640a69b0f05ec9e002e09ed1d7c84d231db00422972c5a02ddef616570d4e7488f697c28933bbf27e5175db61b8cbd2403203b6e30bf431

  • SSDEEP

    196608:B+s5T8f3Hb+IcrthtV80y85WDe+qHw7aJvRt5Oj8GWDAqr:BbT8j+9JkNDJQGuRFDj

Score
7/10
adwarepersistencestealer

Malware Config

Targets

    • Target

      OpenShellSetup_4_4_191.exe

    • Size

      7.9MB

    • MD5

      e0484fd1e79a0227a5923cdc95b511ba

    • SHA1

      bea0cb5c42adbde14e8cf50b64982e1877c7855d

    • SHA256

      9e9c32badb52444ca8a8726aef7c220ff48de8c7916cdfdca4dff6e009ac1f0c

    • SHA512

      80f8b0ac16dfbf7df640a69b0f05ec9e002e09ed1d7c84d231db00422972c5a02ddef616570d4e7488f697c28933bbf27e5175db61b8cbd2403203b6e30bf431

    • SSDEEP

      196608:B+s5T8f3Hb+IcrthtV80y85WDe+qHw7aJvRt5Oj8GWDAqr:BbT8j+9JkNDJQGuRFDj

    Score
    7/10
    adwarepersistencestealer

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Event Triggered Execution

1
T1546

Change Default File Association

1
T1546.001

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

2
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks