aca1a9c9b8902d00d582f58d6293c75cdf9eebd7dcc39e16921a97a1b2dbbd8f

Target
SA_2.7.0.7z
Size 26KB
Sample240905-m3c8vsygpn
SHA256 aca1a9c9b8902d00d582f58d6293c75cdf9eebd7dcc39e16921a97a1b2dbbd8f
MD5 6382ade525c3fd49d50e34b181de9d55
SHA1 1c0d0f762b0aee467ea18ed06da5631b4dab678d
SHA512 db15cb2a7f60ef768335cf294a593849f42347a282c3e9446ec6b2f9d44d1aa94ce32c52bcebd4904869f39266351b8d722a90e1b2fbeb6aa030dc42dc02633e
SSDEEP 768:WaJhRqiUS5rrWN+Zg/eoZlVu8qVh5JTGr2Q:FJhRBU3NNdu9j5JiV
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Targets

- Target
  SA_2.7.0.7z
- Size 26KB
- SHA256 aca1a9c9b8902d00d582f58d6293c75cdf9eebd7dcc39e16921a97a1b2dbbd8f
- MD5 6382ade525c3fd49d50e34b181de9d55
- SHA1 1c0d0f762b0aee467ea18ed06da5631b4dab678d
- SHA512 db15cb2a7f60ef768335cf294a593849f42347a282c3e9446ec6b2f9d44d1aa94ce32c52bcebd4904869f39266351b8d722a90e1b2fbeb6aa030dc42dc02633e
- SSDEEP 768:WaJhRqiUS5rrWN+Zg/eoZlVu8qVh5JTGr2Q:FJhRBU3NNdu9j5JiV
- MD5 SHA1 SHA512 SSDEEP
Score

8^/10

discovery persistence privilege_escalation execution
- Downloads MZ/PE file
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  soshimeeaddons/commands/fps/index.js
- Size 250B
- SHA256 821f7fec9d13258a01d644dc2117430a53c32fabf89be6cfc5e6c7a3d054103a
- MD5 e61f712f5182321fd8bfd63acd33334b
- SHA1 97eeae758d852b6a35c793e3f888ac00033706ec
- SHA512 5cb45afe3befc0622827347a12c3c28cb4f07f4352980f940ef652b1192be02ebf9e28e682d448686612450bbb009536edda99996595e84abed7743fe729a0d6
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral3 behavioral4
- Target
  soshimeeaddons/commands/index.js
- Size 588B
- SHA256 0df9562c6598c959261ee1c3f176ae72902b6ec0867e32a87ec304686e6b8df8
- MD5 720b89277b176f265a16802baffa92e7
- SHA1 86a50b31ae5818dc99b15a5c2eb16925f5640c86
- SHA512 49822da729687083a85f400a7c9778a0b30260a799deb313a59899ce581a29ceeb66dd6300b8fe53a1b84992f500562dd2e72252594255f201a76faecd9c1ccf
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral5 behavioral6
- Target
  soshimeeaddons/commands/ping/index.js
- Size 401B
- SHA256 3423bb2e2145613cfed47c0e16f8ffcb54dea5b79e2e58afe9ef33b594a333ee
- MD5 60b241ee9fdfd58dc7dbe3c3058e0ee1
- SHA1 18012e4bd835cda85d9aba5e3c453a1d81c0e3a2
- SHA512 d92d91e7935c93dfb1f4edf86c6267d4f9c551abbac4f9c84dec7b0e528e36eb245096978a64a9e2bc3e96de4b92fa9b4ba9b0e9359e92da596a018405baba6b
- MD5 SHA1 SHA512
Score

3^/10

discovery execution
behavioral7 behavioral8
- Target
  soshimeeaddons/commands/sa/help/index.js
- Size 381B
- SHA256 ec5dc1f8022d67979c177b3010a5bc2c61b3ba78c817f8e53f3e184b4a68fd22
- MD5 c06133d4bf279e034917def1a3a499c5
- SHA1 d6b862dc211750f6778aad268d187a87f476bdf0
- SHA512 f8b4c3c4b126db544cc84316f76dbccaf2e6b7eda38e9bcb1f7bab2bafa35179237563c7d8e744ae45d696d8e5ae0121f8f07e502c0e8bca3fafcf0c8ebb9b7f
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  soshimeeaddons/commands/sa/index.js
- Size 224B
- SHA256 ae04c4792bbefe35d8e2f797c49a772dbc5478bed9f857bc7555e9f82b8383cb
- MD5 50797b3ce1e723958933439cbda16711
- SHA1 a824f8c771a0d9113481127c5c17a517497a6406
- SHA512 f63a921079c10234b1352caaded1914089e5e01ec3f9d74258d0314a114431866126f5e3185801fca67376fe44646b69aac0b7745d8b834aab53d512f1209913
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  soshimeeaddons/commands/sa/termsim/index.js
- Size 483B
- SHA256 0659d8b6d86b20c69c75f0f2ee1d1ebb859f6ec432a133750ca03a8f6157fe38
- MD5 7252134f8c705e1aed4364a421dd69ef
- SHA1 8e0f1837850d0b256dd2712ed5cd72d239d84a65
- SHA512 7dd2ff4e93976d80ae8b8830841d3422ee3c74bc6c940e2532854002d2a6e637616dea6589b422c05323bd5164b3007219f963791e1529470d391a4a915b8096
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral13 behavioral14
- Target
  soshimeeaddons/commands/sa/termsim/maze.js
- Size 2KB
- SHA256 ed3ed84b593367e524e4d5f1031a4093d5992b8dfafe89fb5ec9c1318271921e
- MD5 8bcf111b08b37418fd87c7387b28c393
- SHA1 b71b26b6dfab83b499257f9875f5f2b605c23710
- SHA512 a5567226b9b018b4ead3acfa40a9d638517635ed016e80055d636bfc54e236a98820d9efdc6c10215174e95ed2b1e4cd01ddbfeb3ecb425ce6b4edcdd5d88275
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral15 behavioral16
- Target
  soshimeeaddons/commands/sa/termsim/numbers.js
- Size 2KB
- SHA256 3aef84efc3fbfd4fa279c0126d3162aaddc858b99c2f42fa92aeef1a58a32e36
- MD5 2c535054b65b89a95fea04b38f39d957
- SHA1 1d654f613c85ba31bb7ab642ffffd4bde0326481
- SHA512 024593cd65608978cc71cf243947f1be1b879ba5c8f812213416193b61c7b6468c9f1fd3184528d1b65d08168be05d88880b034cba0966c135b83daeff1ede63
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral17 behavioral18
- Target
  soshimeeaddons/commands/tps/index.js
- Size 518B
- SHA256 27644e60cc7b551cd2a523c9f4f741ca26d243fa91a6c1e766a371b681d7ab12
- MD5 c65d6f3ed95ff327b4ddd817cc3a3e3f
- SHA1 71105deaad6d974ef17a104dc3980b47ef0de21f
- SHA512 2b41402510a599592a11c46f01085f535f41ea7fed5247d226de8bae37deca3f22f7d8808c31a565e33c8dde278a5869bd1129812afbf726c900c2615fc7ef43
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral19 behavioral20
- Target
  soshimeeaddons/config.js
- Size 16KB
- SHA256 f7f64299e26fb5b848383b91bc069092a54f5af7dc00d8894dabe3f5c5792228
- MD5 670e630f6b343be2e25bc7d5ff2a0e27
- SHA1 0ed4ca2652b655d5a82059f598f0ba2516b032f2
- SHA512 1e7531555413200d6633131d53dce2574395e4ea3dfada5ed9cb0bfd1d6732058ce84388f4a1c20825ca7224b4b882e1e14be920077d5813f3ba172d5967455a
- SSDEEP 192:4i2l5VKSdhijEFt9k6hV9izjM7sST1lija:4isr8+bhV+M79lua
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral21 behavioral22
- Target
  soshimeeaddons/events/closeWindow.js
- Size 1KB
- SHA256 b32486aee34820f88c3839eafe68a83f17ca0ad35f8f74fd595848792b7f40ba
- MD5 b3b175033538c3bc8431199358e1fa49
- SHA1 f32874f6360105a6b64748dc66cbfb4d46bc2e21
- SHA512 e36af46038033af616d5a17c1970a6ba0e7c69edd4efb4d2b22ed976f2e532fe43d0f4afd38382ee8b39aaf538843ac9ec43b4c08bc811ee5372ffa9274d39a2
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral23 behavioral24
- Target
  soshimeeaddons/events/dungeonRoom.js
- Size 2KB
- SHA256 e23202b0aa3dd452834c5bdfebe656503e0b02e2ce97ca7351b8f9729b52054f
- MD5 8da4f9f39af9c6b61b0a8ee0debc31d0
- SHA1 3955a5cc5ca00f529491bc1c804235ec138fa618
- SHA512 9644ecf3b666af27c04caefb1f8a11625a171cf2ae6bb4b67b0f2ed3709ffd183e3eeb6f6af7ee3cce6f9b59c08518fc1093d028bccae99f43c3a38fd641ee78
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral25 behavioral26
- Target
  soshimeeaddons/events/packetBlockChange.js
- Size 1KB
- SHA256 231fa868563d2e1f2a061ab5de81fce2b59cad857bad7c1c8f47eb2ee27e7d35
- MD5 0ed72fd9aaa4ebcb2fba24dc19383fcd
- SHA1 7f60478f2cd8e7bb468233352e17d6b14925c03e
- SHA512 fadebe7d20606e005851b60739707799efb6e21a7364806c55423bdc24a6f83d1eb6c07d99cc64cdb22d821494b2cc4132acb2a91527ab7c983d527c6ffce943
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral27 behavioral28
- Target
  soshimeeaddons/events/packetChat.js
- Size 1KB
- SHA256 388b1c86c10781afa48236ad747f267eefa024efeed5102347d0c2cecddb491b
- MD5 5dcb2462da9f533a5fce191e6cba62d1
- SHA1 1436b13903e128c32561a6fd5863e5a10748b55f
- SHA512 97a4da1299508b60eb6e9e771020fe0b4d3ab0e3f47383a0c7a435ba2ab1e8aebcc30c0f436be67e073958703bf746481cb3ea2b2009fe94af13ff887356ef40
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral29 behavioral30
- Target
  soshimeeaddons/events/packetMultiBlockChange.js
- Size 1KB
- SHA256 3ca7027ceac7951fb1da550f9fa8028cb6092dba2c05e4680970f4945e4082d4
- MD5 70a277315d13786774a7a529889f6bc5
- SHA1 aaa9d4d9dfd3570fb3c164608dc17ee6e1d826bd
- SHA512 ffa62ff628ddbc80a01f040374ffd123f6c18d7e0bd0aa208695259ee3e76a23134701a8582206fb2ce72f1227ee99e84cade166f94fc83c9f1ae745248aa4d4
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Modifies system executable filetype association

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32