Overview

overview

10

Static

static

1

Store-ind-10002.exe

windows10-ltsc 2021-x64

10

Store-ind-10002.exe

windows11-21h2-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Store-ind-10002.exe

  • Size

    181.6MB

  • Sample

    241120-wmgqsa1emj

  • MD5

    aa6c0f982ef38147d29a062f655c79e8

  • SHA1

    3a7f6c67a3f292b17d047397cc6cae663758fb05

  • SHA256

    727a20a3caeb6ba869ea392ebd7b29496fbc08f019b56ed959e48b903e6e14c6

  • SHA512

    edf363155623e10697021b9d191d921d423026be1f537c47de879e97c76bb6b6644af41cdb87af0f6b3cfe0edb186ab056a0e20737220aed789ebb5dfcd8ddbb

  • SSDEEP

    3145728:NkuGirATd5XXMWrjwCMS3JXJVhfSEx/aJjdsw7KwM8JiWb4URJE00cfAAerKzUOJ:airAj5Hwu3JThfhx/aVzo8AKfAAX/M2X

Score
10/10
adwarediscoveryevasionexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Targets

    • Target

      Store-ind-10002.exe

    • Size

      181.6MB

    • MD5

      aa6c0f982ef38147d29a062f655c79e8

    • SHA1

      3a7f6c67a3f292b17d047397cc6cae663758fb05

    • SHA256

      727a20a3caeb6ba869ea392ebd7b29496fbc08f019b56ed959e48b903e6e14c6

    • SHA512

      edf363155623e10697021b9d191d921d423026be1f537c47de879e97c76bb6b6644af41cdb87af0f6b3cfe0edb186ab056a0e20737220aed789ebb5dfcd8ddbb

    • SSDEEP

      3145728:NkuGirATd5XXMWrjwCMS3JXJVhfSEx/aJjdsw7KwM8JiWb4URJE00cfAAerKzUOJ:airAj5Hwu3JThfhx/aVzo8AKfAAX/M2X

    Score
    10/10
    adwarediscoveryevasionexecutionpersistenceprivilege_escalationstealertrojan

    • UAC bypass

      evasiontrojan

    • Drops file in Drivers directory

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Browser Extensions

1
T1176

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks