Overview

overview

8

Static

static

3

MDMAgent.exe

windows10-2004-x64

1

MDMAppInstaller.exe

windows10-2004-x64

1

MRINFO.exe

windows10-2004-x64

1

MRT.exe

windows10-2004-x64

7

MSchedExe.exe

windows10-2004-x64

1

Magnify.exe

windows10-2004-x64

3

MdRes.exe

windows10-2004-x64

1

MdSched.exe

windows10-2004-x64

1

MdmDiagnos...ol.exe

windows10-2004-x64

1

MicrosoftE...st.exe

windows10-2004-x64

1

MicrosoftEdgeCP.exe

windows10-2004-x64

1

MicrosoftE...ls.exe

windows10-2004-x64

1

MicrosoftEdgeSH.exe

windows10-2004-x64

6

MoNotifica...ub.exe

windows10-2004-x64

1

MpSigStub.exe

windows10-2004-x64

1

MsSpellChe...st.exe

windows10-2004-x64

1

MuiUnattend.exe

windows10-2004-x64

4

MultiDigiMon.exe

windows10-2004-x64

1

NDKPerfCmd.exe

windows10-2004-x64

1

NDKPing.exe

windows10-2004-x64

3

NETSTAT.exe

windows10-2004-x64

1

Narrator.exe

windows10-2004-x64

NetCfgNoti...st.exe

windows10-2004-x64

1

NetEvtFwdr.exe

windows10-2004-x64

1

NetHost.exe

windows10-2004-x64

1

Netplwiz.exe

windows10-2004-x64

1

NgcIso.exe

windows10-2004-x64

1

OOBE-Maintenance.exe

windows10-2004-x64

1

OneDriveSetup.exe

windows7-x64

1

OneDriveSetup.exe

windows10-2004-x64

8

OpenWith.exe

windows10-2004-x64

1

OptionalFeatures.exe

windows10-2004-x64

1

Resubmissions

23/08/2024, 16:00

240823-tf47dsteqe6

23/08/2024, 15:32

240823-sy293sseld4

23/08/2024, 15:18

240823-sp1d5athqk8

23/08/2024, 14:12

240823-rjcv7sydnd7

23/08/2024, 02:33

240823-c17dta1cpd7

23/08/2024, 02:11

240823-cmbpzszelg4

23/08/2024, 02:00

240823-ce59mazbnh4

23/08/2024, 01:37

240823-b1992a1dmm5

23/08/2024, 01:24

240823-bsm5jazhpp5

23/08/2024, 00:51

240823-a7p21awhld6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Application Files - system32.zip
  • Size 200.3MB
  • Sample240823-sp1d5athqk
  • SHA256 b9af69ac821a649f211c99e3edf32a76a213e9450b5e972a6cdda5758af530dd
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
discoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target
      MDMAgent.exe
    • Size 168KB
    • SHA256 c0f1eebffd585e0b0b8539200d8b1624567cddf9d88e40aaa40f148c0f2ab3ce
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      MDMAppInstaller.exe
    • Size 188KB
    • SHA256 ea8b096783ee9d05d137c9a9f138328879ef564c4f83aaf42778a4e2dc34c89b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral2
    • Target
      MRINFO.EXE
    • Size 36KB
    • SHA256 e059fa6bf890b2f09efadbd08f733ad8e2d88705b425cf2d31a2ee26b44cfb19
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3
    • Target
      MRT.exe
    • Size 188.0MB
    • SHA256 27f74e49d7263156339c0b950fdbd6c98f633254229085814689ba348ea4d85a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistenceprivilege_escalationspywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral4
    • Target
      MSchedExe.exe
    • Size 100KB
    • SHA256 e287fbed8c9b6c221aa2ba7ee7191be85e9db9e3b5e7978b8b13ba83c13650bd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      Magnify.exe
    • Size 732KB
    • SHA256 8d9f9ea080229ab3e37a58fac74bf0cfae89d04c5735f5111bdb982489526acf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    persistenceprivilege_escalation
    behavioral6
    • Target
      MdRes.exe
    • Size 104KB
    • SHA256 ee1aecc09c8f3d116a63d8f54f54bca0b992795f5ce37dae13c60964095c1116
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      MdSched.exe
    • Size 108KB
    • SHA256 473e783bb18a534d290d6205e3278d8c5e31bb97a926b040eb0b6763e992b892
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      MdmDiagnosticsTool.exe
    • Size 88KB
    • SHA256 0a709ed80041b53da12a27d753fc66ab3cc2e952b359247297dd1fad12e40697
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral9
    • Target
      MicrosoftEdgeBCHost.exe
    • Size 120KB
    • SHA256 7c6691a41d90d952f01503c4c49779a928a623625ba4962b92887a61913e25b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10
    • Target
      MicrosoftEdgeCP.exe
    • Size 120KB
    • SHA256 7c6691a41d90d952f01503c4c49779a928a623625ba4962b92887a61913e25b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11
    • Target
      MicrosoftEdgeDevTools.exe
    • Size 120KB
    • SHA256 7c6691a41d90d952f01503c4c49779a928a623625ba4962b92887a61913e25b5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      MicrosoftEdgeSH.exe
    • Size 80KB
    • SHA256 13b88693808c5cf01d03b5e4cc242f02685c7a1f9e6ccc31a6dce19b33824042
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    evasiontrojan
    behavioral13
    • Target
      MoNotificationUxStub.exe
    • Size 80KB
    • SHA256 ca8947104398c2e1c99357fc004a877cdd381d4887c937cac41defa9160c717b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral14
    • Target
      MpSigStub.exe
    • Size 897KB
    • SHA256 071b0d3a08503a8b88aeeda1d20f371a563377028f6e252dc66cce60ab8f823e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      MsSpellCheckingHost.exe
    • Size 96KB
    • SHA256 1472b5fdba95019219260499e62e34dbe4822723d0c4422159b10930d8e9c858
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16
    • Target
      MuiUnattend.exe
    • Size 112KB
    • SHA256 a15583a62ff9c7ab4029f426a0013da4dd1feed8278ce909e68cc104087d057e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    behavioral17
    • Target
      MultiDigiMon.exe
    • Size 76KB
    • SHA256 4b88ad4a9f7e8081738d33248ad0acd7e7fc64b21fb3f33e3a28dbd5e91ace62
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      NDKPerfCmd.exe
    • Size 53KB
    • SHA256 41c8f4dfbcb6b11c2d20234ef5b31cb3d9839ccd969631c76f9f29402ba3df0f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      NDKPing.exe
    • Size 49KB
    • SHA256 64d64c3c8503e54068d5cace551cd30bb4d5894e59b4082231f348754393403e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral20
    • Target
      NETSTAT.EXE
    • Size 64KB
    • SHA256 6d656d8da855cc4f7d5152d81769124c05bbbcc906408e53dc2cf19e90498c57
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      Narrator.exe
    • Size 596KB
    • SHA256 4801e79129c89c39df996da3be23b0af3f4f9715f2d36ec75ac8fc6708ddc0bf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    persistenceprivilege_escalation
    behavioral22
    • Target
      NetCfgNotifyObjectHost.exe
    • Size 96KB
    • SHA256 32ea8b4937de1ffb4c12b84725c86c17d8c30c794acc2d34805906b140e92e38
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23
    • Target
      NetEvtFwdr.exe
    • Size 52KB
    • SHA256 7fca1bfc349dcad174017969f51e75aa68f0be1998a6d97ec2a3142fa1409fab
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral24
    • Target
      NetHost.exe
    • Size 32KB
    • SHA256 4995247022a423d46cd28e5fa2ec92da287a1a130ef4ca44d668fedc9d9d00da
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral25
    • Target
      Netplwiz.exe
    • Size 64KB
    • SHA256 8011f12e0e13336b432c3f3640894ed5ac1c18fa20ef214c3f6efdd61f268e89
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral26
    • Target
      NgcIso.exe
    • Size 546KB
    • SHA256 c167091f4b985fd8eaf1194697e22d646dc0ca8e01fb68d0cf5bfbe6136c0ae9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27
    • Target
      OOBE-Maintenance.exe
    • Size 122KB
    • SHA256 ebf8d61e11ac5d72511ec6e7116ab5585632abea82834adce487478175206f8c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28
    • Target
      OneDriveSetup.exe
    • Size 48.0MB
    • SHA256 48a181bb27dcdffbf2d467e6004a40677b68d2d07399dd87f5ee0a2b51e5837c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral29behavioral30
    • Target
      OpenWith.exe
    • Size 154KB
    • SHA256 11087185d089bcf1a57be895af6e9ff736dbe7cf53392ca48dbc76fe05eb890b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      OptionalFeatures.exe
    • Size 132KB
    • SHA256 e6ec7d58e0ff6de0fc0e1e1f3f8c3fae84d7dd0817e3eaae0ab0d560172f4c53
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

4
T1546

Accessibility Features

1
T1546.008

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

4
T1546

Accessibility Features

1
T1546.008

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

3
T1112

Credential Access

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

6
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

discoverypersistenceprivilege_escalationspywarestealer
Score
7/10

behavioral5

Score
1/10

behavioral6

persistenceprivilege_escalation
Score
3/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

evasiontrojan
Score
6/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
4/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

discovery
Score
3/10

behavioral21

Score
1/10

behavioral22

persistenceprivilege_escalation
Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

discoverypersistenceprivilege_escalation
Score
8/10

behavioral31

Score
1/10

behavioral32

Score
1/10