Overview

overview

8

Static

static

3

Weave.Mana...up.exe

windows7-x64

8

Weave.Mana...up.exe

windows10-2004-x64

7

$PLUGINSDI...ID.dll

windows7-x64

3

$PLUGINSDI...ID.dll

windows10-2004-x64

3

$PLUGINSDI...nu.dll

windows7-x64

3

$PLUGINSDI...nu.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

Weave Manager.exe

windows7-x64

1

Weave Manager.exe

windows10-2004-x64

6

uninstall.exe

windows7-x64

7

uninstall.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...ls.dll

windows7-x64

3

$PLUGINSDI...ls.dll

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Weave.Manager_1.0.1_x64-setup.exe

  • Size

    3.9MB

  • Sample

    240813-xfq7bazgqb

  • MD5

    2c5bebd2a54ae0926f181f040c85981a

  • SHA1

    c904753953760d4f9040f27ae6c8fec31c3ed732

  • SHA256

    efbabeaac29f69dacc737eebcd0a54b048632e446e6535fd47d68a20672ac060

  • SHA512

    45b740a2d19d335dd1ef97456225df743d84c7352f4522139d64524649ef7374778397477d6b0b6305b77868ce25b2d600ea7ac50c5b974ecd06e0d83d0aed49

  • SSDEEP

    98304:RdtQbJp+YMdUvTwkuogRVaNByLMAV1zZCqbvtb24G7BzoVMqFy//:RkFQXabwvRVqBOZJVa4GFz2Fy//

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      Weave.Manager_1.0.1_x64-setup.exe

    • Size

      3.9MB

    • MD5

      2c5bebd2a54ae0926f181f040c85981a

    • SHA1

      c904753953760d4f9040f27ae6c8fec31c3ed732

    • SHA256

      efbabeaac29f69dacc737eebcd0a54b048632e446e6535fd47d68a20672ac060

    • SHA512

      45b740a2d19d335dd1ef97456225df743d84c7352f4522139d64524649ef7374778397477d6b0b6305b77868ce25b2d600ea7ac50c5b974ecd06e0d83d0aed49

    • SSDEEP

      98304:RdtQbJp+YMdUvTwkuogRVaNByLMAV1zZCqbvtb24G7BzoVMqFy//:RkFQXabwvRVqBOZJVa4GFz2Fy//

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral1behavioral2

    • Target

      $PLUGINSDIR/ApplicationID.dll

    • Size

      198KB

    • MD5

      91c2e2f34b5bba068e9a6178e13a4e5c

    • SHA1

      affcac00894c9afd152e55d0bff7899349edcd6c

    • SHA256

      f6851dcbf0a39edecd8a46564bc455e5273736c3dbcb02b954c201c79ccdf117

    • SHA512

      ce7f629bc0e6e10eca9d671513062f353d8d47666df58c9ad7cc7f767df520b75b2da1f9d6551eae86c738455919463ec89a0c3dc2a8366fa021e6fa6e292000

    • SSDEEP

      3072:/1RnVZfr2qLTV4U3fKHzy/s3fyitDJXqtZnyj80mAg0FubAPl/IJ:/Hnzfr7HU6ipJaLAOKy

    Score
    3/10
    discovery
    behavioral3behavioral4

    • Target

      $PLUGINSDIR/StartMenu.dll

    • Size

      7KB

    • MD5

      d070f3275df715bf3708beff2c6c307d

    • SHA1

      93d3725801e07303e9727c4369e19fd139e69023

    • SHA256

      42dd4dda3249a94e32e20f76eaffae784a5475ed00c60ef0197c8a2c1ccd2fb7

    • SHA512

      fcaf625dac4684dad33d12e3a942b38489ecc90649eee885d823a932e70db63c1edb8614b9fa8904d1710e9b820e82c5a37aeb8403cf21cf1e3692f76438664d

    • SSDEEP

      96:h8dPIKJhMuhik+CfoEwknt6io8zv+qy5/utta/H3lkCTcaqHCI:yZIKXgk+cx6QYFkAXlncviI

    Score
    3/10
    discovery
    behavioral5behavioral6

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral7behavioral8

    • Target

      $PLUGINSDIR/nsDialogs.dll

    • Size

      9KB

    • MD5

      6c3f8c94d0727894d706940a8a980543

    • SHA1

      0d1bcad901be377f38d579aafc0c41c0ef8dcefd

    • SHA256

      56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2

    • SHA512

      2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355

    • SSDEEP

      96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc

    Score
    3/10
    discovery
    behavioral10behavioral9

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      1.0MB

    • MD5

      db3d74dd0f4bf325afddf6fc9e9a019c

    • SHA1

      a21c67cf5ab6d4274afff0d68cfce680d213ddc7

    • SHA256

      5c89170e961dc791f009188b92d180faa219d2987c948471e3305baf381ee4af

    • SHA512

      b8639f59d2110a42e831429e46308365308a309b1edd36626f0d8e607ff9c4338c16de4021cd154a8a843a58075bbeea669aee00b69cc428a42011a2855db2ab

    • SSDEEP

      24576:RwGY/pqQbkk2M3sVfktHdr0BQn652/OyliTmcdlgVIH06iy:uNI8tw1d2IU6i

    Score
    3/10
    discovery
    behavioral11behavioral12

    • Target

      Weave Manager.exe

    • Size

      10.9MB

    • MD5

      f666a88560d75d7aef9fbae993970327

    • SHA1

      23e4d187271b1eb4a7c19faf1d1ed42f16c2b351

    • SHA256

      d48410a166a44a39447efc2d592f166e5b5f28c308992b514a8171f6ac27591b

    • SHA512

      c1a06f1d021274a73c719cceefccd8448274aa9459ecea5d355dd93cdc114058f9578537328185af61fffdffe0e7b8c2c05bad5d79ce84092ee5477eb996c308

    • SSDEEP

      98304:o674xa/ddRnqOgLsDvv90iaY+QoX5UoXhlHxEj1O/dEqfalfKcg94uAIbdsy3Vg7:Tq2Mfm4dvqkiv7E4lJ

    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral13behavioral14

    • Target

      uninstall.exe

    • Size

      624KB

    • MD5

      4c045fb7943eaa5e141df5219b599f8f

    • SHA1

      2e296ffd85bd3ea7e988456fec925a656593d3a8

    • SHA256

      6f8f1f64b6e1b72172166c129e131ae8ac697657066ca1435fee0f1b15a049b0

    • SHA512

      613d2d6a11423e8382c0adfd3a3ec97bdddb28c00cc4f1dcaaec3b8f6f95079b9c0478b9cde032b72d5f05ccc57dd67c6d858fac7d4c37706408dc6818557819

    • SSDEEP

      12288:QYuyqP5pKn69U1Nd291aj4+rMgi/X2KKBGVWOyr:QYuxna696rkMXGVWO2

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral15behavioral16

    • Target

      $PLUGINSDIR/LangDLL.dll

    • Size

      5KB

    • MD5

      68b287f4067ba013e34a1339afdb1ea8

    • SHA1

      45ad585b3cc8e5a6af7b68f5d8269c97992130b3

    • SHA256

      18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026

    • SHA512

      06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb

    • SSDEEP

      48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L

    Score
    3/10
    discovery
    behavioral17behavioral18

    • Target

      $PLUGINSDIR/System.dll

    • Size

      12KB

    • MD5

      cff85c549d536f651d4fb8387f1976f2

    • SHA1

      d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e

    • SHA256

      8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8

    • SHA512

      531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88

    • SSDEEP

      192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr

    Score
    3/10
    discovery
    behavioral19behavioral20

    • Target

      $PLUGINSDIR/nsis_tauri_utils.dll

    • Size

      1.0MB

    • MD5

      db3d74dd0f4bf325afddf6fc9e9a019c

    • SHA1

      a21c67cf5ab6d4274afff0d68cfce680d213ddc7

    • SHA256

      5c89170e961dc791f009188b92d180faa219d2987c948471e3305baf381ee4af

    • SHA512

      b8639f59d2110a42e831429e46308365308a309b1edd36626f0d8e607ff9c4338c16de4021cd154a8a843a58075bbeea669aee00b69cc428a42011a2855db2ab

    • SSDEEP

      24576:RwGY/pqQbkk2M3sVfktHdr0BQn652/OyliTmcdlgVIH06iy:uNI8tw1d2IU6i

    Score
    3/10
    discovery
    behavioral21behavioral22

MITRE ATT&CK Enterprise v15

Tasks