General
-
Target
Omnisphere 2 v2.0.3-installer.exe
-
Size
16.8MB
-
Sample
241031-npmqtawjft
-
MD5
bb3b2b00a572491d8cfab96b9aeef58d
-
SHA1
507089191a57eb66ae06750c8a05ae971985d7ea
-
SHA256
fc7310716d572284bab25d77437fc2928bbb989c49260f7ffb0aa59071e4d13b
-
SHA512
79b925de3f6439316d56c96f08195f8b061c1f8638a5e75e3c40e659deae223d1fdd233abc7bb8c0b65f50308d6e661548421b447d106103fad00f210dd232b1
-
SSDEEP
393216:YsoVRnOyazuULBdQuslN/m3pCfrAZYCuPJOMJ4ISegLV4a825Zom9HmAvlDx:YsoHOxzuidQu4KCMJuxv45zLBom9G4Dx
Behavioral task
behavioral1
Sample
Omnisphere 2 v2.0.3-installer.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral2
Sample
obfuscated_compressed_omnisphere.pyc
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Omnisphere 2 v2.0.3-installer.exe
-
Size
16.8MB
-
MD5
bb3b2b00a572491d8cfab96b9aeef58d
-
SHA1
507089191a57eb66ae06750c8a05ae971985d7ea
-
SHA256
fc7310716d572284bab25d77437fc2928bbb989c49260f7ffb0aa59071e4d13b
-
SHA512
79b925de3f6439316d56c96f08195f8b061c1f8638a5e75e3c40e659deae223d1fdd233abc7bb8c0b65f50308d6e661548421b447d106103fad00f210dd232b1
-
SSDEEP
393216:YsoVRnOyazuULBdQuslN/m3pCfrAZYCuPJOMJ4ISegLV4a825Zom9HmAvlDx:YsoHOxzuidQu4KCMJuxv45zLBom9G4Dx
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies RDP port number used by Windows
-
Sets service image path in registry
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Drops startup file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
-
-
-
Target
obfuscated_compressed_omnisphere.pyc
-
Size
212KB
-
MD5
619aa99de67f8af4134802f4e440a639
-
SHA1
d86dd7c6e6944836a05807d05a5bfb078ae374e7
-
SHA256
1ed78b0c65e527a43c3dab6ddf40f73693a6485bc1c326d3885a7ee7cde10b77
-
SHA512
7ab1eeabadfb3f30f7b3088a873a81e695cd5e7afcc155812dfce5face7029cadfe3627c221b5ccf1b32278249bd72daa6dcd5a46cfd0d82c163632a1b5255bc
-
SSDEEP
6144:cNhd/4WFwQR8ur5do/S41M/MlVxT/wzW9IOcDLtDrk:cNhd/4WFwQR8ur5do/S41M/MlVxT/wzg
Score3/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3