Overview

overview

8

Static

static

3

Internet D...at.url

windows7-x64

3

Internet D...at.url

windows10-2004-x64

3

IDM_6.4x_C....7.exe

windows7-x64

8

IDM_6.4x_C....7.exe

windows10-2004-x64

8

Internet D...20.exe

windows7-x64

8

Internet D...20.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    71c70d0e10fd1496e42155f3dfd1a775a519b113ad1b846ccd766e1162be4593

  • Size

    11.7MB

  • Sample

    241112-fdyd6strew

  • MD5

    ee2c03f9703f98aa5fa9f0e26e3114cb

  • SHA1

    3323ab71def43a52f9270d18200f908533bb2a27

  • SHA256

    71c70d0e10fd1496e42155f3dfd1a775a519b113ad1b846ccd766e1162be4593

  • SHA512

    7566139245a14b8885fd5515e1a55f147a1ad85f013321107a536f734702524c5bb26f07e4ce1c03b0f08ca328b89edd07525b722f9386aa281caba6e16d6769

  • SSDEEP

    196608:n4/9JBuYnrJ9UGbqh1GY3EF12xZxMw1jtx4FvXYdtTz6nd4WbHtP426dX4x3:nwiYnrYGbqh1GYvKKc1XOqd/hP6IF

Score
8/10
adwarediscoveryevasionpersistencephishingprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      Internet Download Manager (IDM) v6.42 Build 20 + Fix [Lifetime Activation] {CracksHash}/Download Latest Cracks and Apps from CracksHash.com.url

    • Size

      117B

    • MD5

      2fe280a0aeda1ec09a93f82d81219217

    • SHA1

      b5e8792e2b7f729e714e1a8008fd9fec54f4eb8d

    • SHA256

      cdbfe5133e2845993b32f14966ee8998ef5c4593234065b8dd5081cb5ec69631

    • SHA512

      a34929f385b1302385f7f0d774ddd74d0c922e10f6b1b84fdf3e554a1a9e564abe08b65eea70a5c6060711467e4dfa8e587ce861272f8ea3e0b576d3150af3cf

    Score
    3/10
    discovery
    behavioral1behavioral2

    • Target

      IDM_6.4x_Crack_v19.7.exe

    • Size

      59KB

    • MD5

      27016937b5781c4f84b6b3432170f4d0

    • SHA1

      bc812a8c4d44a3503ffd6a46e4fdab925c622344

    • SHA256

      fc1a02b509b8f351ac45bd45efd4e7296b365545a48ffd6a14e8e07bc7189155

    • SHA512

      24a726276cc53c5a0d075d1bf930e24b3a1891e0754b17c28a5a35b5677fd792d9adb55e5e0a7fe18f056febb8af4a49a5a0fac33389205d1f4dcc0060422be7

    • SSDEEP

      1536:5ilGC+HMax3AZ5GiavgfreZCRIr71mazhAN5TAS:5igLV3SIareERU5mazh3S

    Score
    8/10
    discoveryevasion

    • Blocks application from running via registry modification

      Adds application to list of disallowed applications.

      evasion

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Disables cmd.exe use via registry modification

      evasion
    behavioral3behavioral4

    • Target

      Internet Download Manager (IDM) v6.42 Build 20 + Fix [Lifetime Activation] {CracksHash}/Setup/idman642build20.exe

    • Size

      11.7MB

    • MD5

      7d6cf347c974d5397f2d26a40d6b368f

    • SHA1

      5c2f4d70d716d6c80bc46f7eaeba5f8c11507735

    • SHA256

      3c13026f17ca2d88214175e7d47dd51c396e95ed0dc8b14ba8b27e11ab9221c6

    • SHA512

      53762da6bc5f04549fb82040e5ed7b090451a170f464f2b5c860a1c73386eb328f2942b40a90cf3bc66a5640e032001a79eab8a4f509991e4c3059cd9351cf8e

    • SSDEEP

      196608:lZ5pK05fHg8IyT6e11mrWPNY631IUB7vJ8hr9RfsNR+FZmMBvTKD2pengSiJ:Zc05fvIyue0kYFSWV9mR4ZF4KpgHA

    Score
    8/10
    adwarediscoverypersistencephishingprivilege_escalationspywarestealer

    • Drops file in Drivers directory

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral5behavioral6

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Browser Extensions

1
T1176

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks