Overview

overview

7

Static

static

7

Dislyte_se....4.exe

windows11-21h2-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dislyte_setup_0.0.4.exe

  • Size

    13.0MB

  • Sample

    241208-rcgwksvrex

  • MD5

    f30399c8bf4eb9a17131d690ff0ad6ae

  • SHA1

    5470e2299335b7cc842ebaa5f037249ded8a14c8

  • SHA256

    578a311c3e56fd9bdba19b2b77d51042b29990645fe19a3725c52ac05cf3d499

  • SHA512

    7efd180f87e2b3e2f4442b57b64e1ad23a0f77add7228d386edb3c68234ace902e3466ac8ecf294a156439fcef727d8b73cab84439cab72cd3a3f37419647891

  • SSDEEP

    393216:TXZsb9BjOBTuKPTm89HldLz5tg4iX8zZiN6:TI9xO77vldv5tgn6z

Score
7/10
discoverylinkpdfpersistenceprivilege_escalationqrupx

Malware Config

Targets

    • Target

      Dislyte_setup_0.0.4.exe

    • Size

      13.0MB

    • MD5

      f30399c8bf4eb9a17131d690ff0ad6ae

    • SHA1

      5470e2299335b7cc842ebaa5f037249ded8a14c8

    • SHA256

      578a311c3e56fd9bdba19b2b77d51042b29990645fe19a3725c52ac05cf3d499

    • SHA512

      7efd180f87e2b3e2f4442b57b64e1ad23a0f77add7228d386edb3c68234ace902e3466ac8ecf294a156439fcef727d8b73cab84439cab72cd3a3f37419647891

    • SSDEEP

      393216:TXZsb9BjOBTuKPTm89HldLz5tg4iX8zZiN6:TI9xO77vldv5tgn6z

    Score
    6/10
    discoverylinkpdfpersistenceprivilege_escalation

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks