General

  • Target

    Adobe_Acrobat_Pro_DC_2021_v21.001.20145__Fix_CracksHash.torrent

  • Size

    21KB

  • Sample

    240522-v1l2zsae2y

  • MD5

    652d927066b39160f87c0a1b4104f949

  • SHA1

    6d5cfd4c989a3a86c72226ab0d25ad738d3ed736

  • SHA256

    bba5d05b8422f1d0619d09e44ec40f3e45f53ce358be0bb0eb9d86f03ee2d955

  • SHA512

    5b40804422da38d233f40ab3f65c6a3bbd4a16679b1217d8b66cb48a1b5aabdbd1743efe2098e5392520633f72ded9a6fc33311b613cfab0237af1aa9ef0706c

  • SSDEEP

    384:knWP7cNAhSiuHyw/pe78cgmLBzOXQ6LEgPAS6Aq4Ysnyz1SQBkIXzYmBM3ehWV:kn4cmM/Y78cgmNzkogPAS6AqAokIXzYZ

Malware Config

Targets

    • Target

      Adobe_Acrobat_Pro_DC_2021_v21.001.20145__Fix_CracksHash.torrent

    • Size

      21KB

    • MD5

      652d927066b39160f87c0a1b4104f949

    • SHA1

      6d5cfd4c989a3a86c72226ab0d25ad738d3ed736

    • SHA256

      bba5d05b8422f1d0619d09e44ec40f3e45f53ce358be0bb0eb9d86f03ee2d955

    • SHA512

      5b40804422da38d233f40ab3f65c6a3bbd4a16679b1217d8b66cb48a1b5aabdbd1743efe2098e5392520633f72ded9a6fc33311b613cfab0237af1aa9ef0706c

    • SSDEEP

      384:knWP7cNAhSiuHyw/pe78cgmLBzOXQ6LEgPAS6Aq4Ysnyz1SQBkIXzYmBM3ehWV:kn4cmM/Y78cgmNzkogPAS6AqAokIXzYZ

    • Creates a large amount of network flows

      This may indicate a network scan to discover remotely running services.

    • Contacts a large (550) amount of remote hosts

      This may indicate a network scan to discover remotely running services.

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Registers new Print Monitor

    • Sets file execution options in registry

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Registers COM server for autorun

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks