Overview

overview

9

Static

static

9

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...or.exe

windows11-21h2-x64

1

tox tweaki...CK.exe

windows11-21h2-x64

9

tox tweaki...ew.exe

windows11-21h2-x64

6

tox tweaki...up.exe

windows11-21h2-x64

1

tox tweaki...8.appx

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

Microsoft.UI.Xaml.dll

windows11-21h2-x64

1

tox tweaki...up.exe

windows11-21h2-x64

8

tox tweaki...LG.exe

windows11-21h2-x64

1

tox tweaki...el.exe

windows11-21h2-x64

1

tox tweaki...un.exe

windows11-21h2-x64

3

Export.bat

windows11-21h2-x64

1

Import.bat

windows11-21h2-x64

1

SCEWIN_64.exe

windows11-21h2-x64

1

amifldrv64.sys

windows11-21h2-x64

1

amigendrv64.sys

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

1

tox tweaki...CL.exe

windows11-21h2-x64

1

tox tweaki...64.exe

windows11-21h2-x64

7

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...64.sys

windows11-21h2-x64

1

tox tweaki...vc.exe

windows11-21h2-x64

1

CRU/CRU.exe

windows11-21h2-x64

3

CRU/reset-all.exe

windows11-21h2-x64

3

CRU/restart.exe

windows11-21h2-x64

5

CRU/restart64.exe

windows11-21h2-x64

5

tox tweaki...on.exe

windows11-21h2-x64

1

Export.bat

windows11-21h2-x64

3

tox tweaki...ll.exe

windows11-21h2-x64

7

tox tweaki...xp.exe

windows11-21h2-x64

8

tox tweaki...tr.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    edkdpu.zip
  • Size 77.7MB
  • Sample241108-sblntavank
  • SHA256 f45bcf726922fe01b71eb17cdaea8fcea57bdeefced3054e118732a41805f15f
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
adwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

Malware Config

Targets

    • Target
      tox tweaking/Emu/KeyAuthEmulator.dll
    • Size 22KB
    • SHA256 8997bb8b9ffb50c9387f906e42a64f52ac0b686e26153257b5bf0c1aad30fd79
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1
    • Target
      tox tweaking/Emu/KeyAuthEmulator.exe
    • Size 135KB
    • SHA256 71fede3d07f8b24d08e15748abcd95abcfe48e21a5a71f0c96d6bf752c12252c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral2
    • Target
      tox tweaking/ToX Premium UtilityCRACK.exe
    • Size 37.8MB
    • SHA256 ed4ede2502e8af6c22df6a697fa66c04ed4ce241ceecdf00ed32b27faa22afe8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    discovery

    • Detected Nirsoft tools

      Free utilities often used by attackers which can steal passwords, product keys, etc.

    behavioral3
    • Target
      tox tweaking/niggers/DevManView.exe
    • Size 163KB
    • SHA256 9abdc7cdc19548ada451aee6caabe296957c050062991892e7d9787ff6e0bdef
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    behavioral4
    • Target
      tox tweaking/niggers/DeviceCleanup.exe
    • Size 21KB
    • SHA256 4f37b11d7cf3ede7e30bfbafa697c0e08eecdc000d0fb14b5956da1adc0a87bd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5
    • Target
      tox tweaking/niggers/Microsoft-uiXAML2.8.Appx
    • Size 4.9MB
    • SHA256 d3c222a694aece945c98da01bb412b3da1e36428efa353665ac38e96127f3f49
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      Microsoft.UI.Xaml.dll
    • Size 5.9MB
    • SHA256 3f761d13cddc2148368403460c31e09596a42f5be439b4568956a2feaa77bb20
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral7
    • Target
      Microsoft.UI.Xaml.winmd
    • Size 279KB
    • SHA256 2bf1f13298fda7f3eedf66a19bde55f9de0a57e902a9a60bc6ac37c9c4cf9d0b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      tox tweaking/niggers/MicrosoftEdgeSetup.exe
    • Size 1.6MB
    • SHA256 7531341da720162541747b3142722f9c52d9d5fe57678d8aeefa62532014f672
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    adwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      evasiontrojan

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral9
    • Target
      tox tweaking/niggers/NSudoLG.exe
    • Size 174KB
    • SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10
    • Target
      tox tweaking/niggers/NVIDIA Control Panel.exe
    • Size 13.5MB
    • SHA256 066365731d031099bf04198644e38fdf620113b2eb08a351610273751ad92671
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11
    • Target
      tox tweaking/niggers/PowerRun.exe
    • Size 775KB
    • SHA256 c0abbeea8ae726503bc5643f3471e378d92fcb59a37043062bbf9ba64d95004c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral12
    • Target
      Export.bat
    • Size 529B
    • SHA256 283d6ea32f1aa30985dc7ff1564e345ef62ca8193d764418b3031bbba82bb7da
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral13
    • Target
      Import.bat
    • Size 739B
    • SHA256 dc0f3e8f2d484742469d768266ca833fe7330d618770b628bcbaeb6bb40df6fd
    • MD5 SHA1 SHA512
    Score
    1/10
    behavioral14
    • Target
      SCEWIN_64.exe
    • Size 668KB
    • SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15
    • Target
      amifldrv64.sys
    • Size 28KB
    • SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral16
    • Target
      amigendrv64.sys
    • Size 34KB
    • SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17
    • Target
      tox tweaking/niggers/SCEWIN_64.exe
    • Size 668KB
    • SHA256 2d78e7bb62fcab44c54fe853f51e8836ada45ea374027423bcb6d7a5db46502b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      tox tweaking/niggers/SetACL.exe
    • Size 601KB
    • SHA256 4efc87b7e585fcbe4eaed656d3dbadaec88beca7f92ca7f0089583b428a6b221
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19
    • Target
      tox tweaking/niggers/VC_redist.x64.exe
    • Size 24.2MB
    • SHA256 1ad7988c17663cc742b01bef1a6df2ed1741173009579ad50a94434e54f56073
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral20
    • Target
      tox tweaking/niggers/amifldrv64.sys
    • Size 28KB
    • SHA256 e7cbfb16261de1c7f009431d374d90e9eb049ba78246e38bc4c8b9e06f324b6f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral21
    • Target
      tox tweaking/niggers/amigendrv64.sys
    • Size 34KB
    • SHA256 ffc72f0bde21ba20aa97bee99d9e96870e5aa40cce9884e44c612757f939494f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22
    • Target
      tox tweaking/niggers/bfsvc.exe
    • Size 108KB
    • SHA256 71bdc378d175b6b2df23f5f8d394e5e90805a4e0b3e346588dc7dfe14de3dcfa
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral23
    • Target
      CRU/CRU.exe
    • Size 1.2MB
    • SHA256 0351a943ca93558ff36f74c3f0c768dceb724e833e282abcf1be5b2e71d5c67b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral24
    • Target
      CRU/reset-all.exe
    • Size 51KB
    • SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25
    • Target
      CRU/restart.exe
    • Size 63KB
    • SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Drops file in System32 directory

    behavioral26
    • Target
      CRU/restart64.exe
    • Size 73KB
    • SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10

    • Drops file in System32 directory

    behavioral27
    • Target
      tox tweaking/niggers/devcon.exe
    • Size 80KB
    • SHA256 a51e25acc489948b31b1384e1dc29518d19b421d6bc0ced90587128899275289
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral28
    • Target
      Export.bat
    • Size 1KB
    • SHA256 4b1cd4bf80557c80689d6f06b15e63a3f6a3ff66db3d8bebe237d86d82cb6e46
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral29
    • Target
      tox tweaking/niggers/openshell.exe
    • Size 7.9MB
    • SHA256 31e616f27fad0c9b14a22c02ded2dc524411abf53d72c4136f22db1be0156865
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    adwarediscoverypersistenceprivilege_escalationstealer

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral30
    • Target
      tox tweaking/niggers/procexp.exe
    • Size 2.7MB
    • SHA256 0f2081ebd2ef0baafdd699dbd1b77853a35b50943418ed6207f896599f41084c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    8/10
    discoverypersistence

    • Drops file in Drivers directory

    • Sets service image path in registry

      persistence

    • Executes dropped EXE

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral31
    • Target
      tox tweaking/niggers/str.exe
    • Size 136KB
    • SHA256 fe3cdbe2e332e48921ffa2a9697a66f71472d878154ba331d12adc7e7c767a2b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Browser Extensions

1
T1176

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

2
T1547.001

Event Triggered Execution

3
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Modify Registry

8
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

3
T1120

Query Registry

8
T1012

System Information Discovery

8
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
9/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

discovery
Score
9/10

behavioral4

Score
6/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

adwarediscoveryevasionpersistenceprivilege_escalationspywarestealertrojan
Score
8/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

discovery
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

discovery
Score
7/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
5/10

behavioral27

Score
5/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

adwarediscoverypersistenceprivilege_escalationstealer
Score
7/10

behavioral31

discoverypersistence
Score
8/10

behavioral32

Score
1/10