hxxps://mistermodzz[.]com | Triage

Submit
Reports

Overview

overview

Static

static

1

URLScan

urlscan

1

https://mistermodzz....

windows11-21h2-x64

Resubmissions

03/08/2024, 02:56

240803-dfezha1clj 9

03/08/2024, 02:53

240803-ddg13swajc 8

03/08/2024, 02:42

240803-c7cssavgkf 10

Sharing

Copy URL Twitter E-mail

General

Target

https://mistermodzz.com
Sample

240803-c7cssavgkf

Score

10^/10

credential_access defense_evasion discovery evasion motw persistence phishing privilege_escalation ransomware spyware stealer trojan upx

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

https://mistermodzz.com

Resource

win11-20240802-en

credential_access defense_evasion discovery evasion motw persistence phishing privilege_escalation ransomware spyware stealer trojan upx

windows11-21h2-x64

41 signatures

300 seconds

Malware Config

Targets

- Target
  
  https://mistermodzz.com
Score

10^/10

credential_access defense_evasion discovery evasion motw persistence phishing privilege_escalation ransomware spyware stealer trojan upx
- Modifies WinLogon for persistence
  persistence
- UAC bypass
  evasion trojan
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Disables RegEdit via registry modification
  evasion
- Downloads MZ/PE file
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Mark of the Web detected: This indicates that the page was originally saved or cloned.
  phishing motw
- Hide Artifacts: Hidden Files and Directories
  defense_evasion
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Winlogon Helper DLL

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Subvert Trust Controls

SIP and Trust Provider Hijacking

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Unsecured Credentials

Credentials In Files

Discovery

Browser Information Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Wi-Fi Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Web Service

Exfiltration

Impact

Defacement

Tasks

static1

urlscan1

behavioral1

credential_accessdefense_evasiondiscoveryevasionmotwpersistencephishingprivilege_escalationransomwarespywarestealertrojanupx

© 2018-2025

Terms | Privacy