Resubmissions
10-11-2024 21:18
241110-z5t1lsylfk 1010-11-2024 20:58
241110-zr6r9avgpd 810-11-2024 20:52
241110-znx1yavgje 310-11-2024 20:50
241110-zm2yhatrez 310-11-2024 20:49
241110-zl3teatrdt 709-11-2024 18:09
241109-wrfpaazapa 809-11-2024 18:08
241109-wra4ssylcv 409-11-2024 18:08
241109-wq58jszbjp 409-11-2024 18:08
241109-wq2kcsylcs 309-11-2024 17:57
241109-wjyvwsyhmb 8General
-
Target
http://itch.io
-
Sample
241110-z5t1lsylfk
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://itch.io
Resource
win11-20241007-en
Malware Config
Targets
-
-
Target
http://itch.io
-
Modifies security service
-
Creates new service(s)
-
Downloads MZ/PE file
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Possible privilege escalation attempt
-
A potential corporate email address has been identified in the URL: 7742037254C95E840A4C98A6@AdobeOrg
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2SIP and Trust Provider Hijacking
2