Overview

overview

8

Static

static

3

WinLiveInfo (1).exe

windows7-x64

7

WinLiveInfo (1).exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WinLiveInfo (1).exe

  • Size

    20.8MB

  • Sample

    250328-v194tayyhs

  • MD5

    8b4bd3821cab86b9c961b0481a064cfc

  • SHA1

    1caf1ba2fe2c8f15a9d4392b4839a0f7b643aaaf

  • SHA256

    06f6595b8642674f097dd5962f01a17b775a194fc28e4d7163c8ada15deaa47a

  • SHA512

    ea3d6c02a520f4afa91d18c2aeaf8553e5db6927747c078c546422f234cc453eb522de33fec7a83e97bbba72093e268bf1f3aaa16ded5e3be5256742e9b2d055

  • SSDEEP

    393216:wh9S6Ac+TGz7kMIEZhgYBvWg1WPbBzM/wH:a9H97lBBvWg1sbhf

Score
8/10
collectiondiscoveryexecutionpersistenceprivilege_escalationpyinstallerspywarestealerupx

Malware Config

Targets

    • Target

      WinLiveInfo (1).exe

    • Size

      20.8MB

    • MD5

      8b4bd3821cab86b9c961b0481a064cfc

    • SHA1

      1caf1ba2fe2c8f15a9d4392b4839a0f7b643aaaf

    • SHA256

      06f6595b8642674f097dd5962f01a17b775a194fc28e4d7163c8ada15deaa47a

    • SHA512

      ea3d6c02a520f4afa91d18c2aeaf8553e5db6927747c078c546422f234cc453eb522de33fec7a83e97bbba72093e268bf1f3aaa16ded5e3be5256742e9b2d055

    • SSDEEP

      393216:wh9S6Ac+TGz7kMIEZhgYBvWg1WPbBzM/wH:a9H97lBBvWg1sbhf

    Score
    8/10
    upxcollectiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

      collection

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Remote System Discovery

1
T1018

System Information Discovery

1
T1082

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

Wi-Fi Discovery

1
T1016.002

Lateral Movement

Collection

Clipboard Data

1
T1115

Data from Local System

1
T1005

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks