Overview

overview

8

Static

static

1

logioption...er.exe

windows7-x64

1

logioption...er.exe

windows10-2004-x64

8

Resubmissions

25-04-2024 07:19

240425-h5msvsgg8z 8

25-04-2024 07:13

240425-h18jrsgf89 6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    logioptionsplus_installer.exe

  • Size

    29.4MB

  • Sample

    240425-h5msvsgg8z

  • MD5

    1052827b60890d7cb9b45d4842c9efd2

  • SHA1

    06545f95abefd335810a6ee7784789de08350714

  • SHA256

    ea539312b9e016690fdf97b1fdd3b422dc88161977d5d008a60a75163c6737aa

  • SHA512

    4dfdf34dbdffa596e36d1cddfbc12c3b1406b8cce272078774bae6da0a788d8434c637b9ff8c827ddc1dcc1ac1f24a7df48cffee30250b9ad2a1cdf6773f86e8

  • SSDEEP

    393216:kdnsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS23oxN2bz5frx1CmDfa+U2:kdn+5GU6upttD7yBG/PcXU9g52iN2hv

Score
8/10
discoveryevasion

Malware Config

Targets

    • Target

      logioptionsplus_installer.exe

    • Size

      29.4MB

    • MD5

      1052827b60890d7cb9b45d4842c9efd2

    • SHA1

      06545f95abefd335810a6ee7784789de08350714

    • SHA256

      ea539312b9e016690fdf97b1fdd3b422dc88161977d5d008a60a75163c6737aa

    • SHA512

      4dfdf34dbdffa596e36d1cddfbc12c3b1406b8cce272078774bae6da0a788d8434c637b9ff8c827ddc1dcc1ac1f24a7df48cffee30250b9ad2a1cdf6773f86e8

    • SSDEEP

      393216:kdnsqS5Gwb6+lptVYmfr7yBG/4oyFN/YuuccKU9oxcS23oxN2bz5frx1CmDfa+U2:kdn+5GU6upttD7yBG/PcXU9g52iN2hv

    Score
    8/10
    discoveryevasion

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Subvert Trust Controls

2
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Install Root Certificate

1
T1553.004

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks