Overview

overview

8

Static

static

1

liquidlaun...US.msi

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    liquidlauncher_0.2.6_x64_en-US.msi

  • Size

    7.4MB

  • Sample

    240423-h1rw1sed51

  • MD5

    a7fcc23900775d1a30aec2577fb8d422

  • SHA1

    f8afd7e767ae8856ca9510b1dfd19649cade451d

  • SHA256

    f3e22905236070c8efaba67d635b3c943af34893adf862e06d93ba98ebb51d96

  • SHA512

    945d65bc7d53326b93d0f09f7f42b84f4eedbc1fc8923b51423fc18df840d7104aa677b311f031994228e22ce9186d840496650d37c3eee4ebcec48cc1d611d2

  • SSDEEP

    196608:qTh+4jAxIhDfKObYAsa9lsKqBBgk8pZV/VXps2S:2+1wLKUYva96KqBqk8x/Vh

Score
8/10
adwarediscoveryevasionpersistencestealertrojan

Malware Config

Targets

    • Target

      liquidlauncher_0.2.6_x64_en-US.msi

    • Size

      7.4MB

    • MD5

      a7fcc23900775d1a30aec2577fb8d422

    • SHA1

      f8afd7e767ae8856ca9510b1dfd19649cade451d

    • SHA256

      f3e22905236070c8efaba67d635b3c943af34893adf862e06d93ba98ebb51d96

    • SHA512

      945d65bc7d53326b93d0f09f7f42b84f4eedbc1fc8923b51423fc18df840d7104aa677b311f031994228e22ce9186d840496650d37c3eee4ebcec48cc1d611d2

    • SSDEEP

      196608:qTh+4jAxIhDfKObYAsa9lsKqBBgk8pZV/VXps2S:2+1wLKUYva96KqBqk8x/Vh

    Score
    8/10
    adwarediscoveryevasionpersistencestealertrojan

    • Blocklisted process makes network request

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Downloads MZ/PE file

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Browser Extensions

1
T1176

Privilege Escalation

Boot or Logon Autostart Execution

4
T1547

Registry Run Keys / Startup Folder

4
T1547.001

Defense Evasion

Modify Registry

6
T1112

Credential Access

Discovery

System Information Discovery

7
T1082

Query Registry

6
T1012

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks