Overview

overview

10

Static

static

3

PassatHook.exe

windows7-x64

1

PassatHook.exe

windows10-2004-x64

Resubmissions

28/03/2025, 19:50

250328-ykn37azzgv 10

28/03/2025, 19:45

250328-ygeeksslv2 10

28/03/2025, 19:28

250328-x6yn3szybz 10

28/03/2025, 19:13

250328-xxc11szxbt 8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PassatHook.exe

  • Size

    14.7MB

  • Sample

    250328-ygeeksslv2

  • MD5

    eafb67ed7734f5561c709b64e6e36b8f

  • SHA1

    d7d5859993759ef0079a92506a9eed6a11fbdf48

  • SHA256

    1c1e61fa3ca755e7f1616263bcf948ce2a22ae9d01dac95d4093f59ec5e42ce3

  • SHA512

    f152eab4c9b4d80ccfb9d9aea316838ea2f10376d681b1371dee02484fa68e8949a05c5fd6536f21939f036bd70cc179e364099d59f3aa3645bb8534b8f2c692

  • SSDEEP

    393216:l++AaWnPOESRAc5OKC4JLXH9ip87knYOwPecB:HtQtgk4JrYp8gYOUf

Score
10/10
defense_evasiondiscoverypersistenceprivilege_escalationransomwaretrojan

Malware Config

Targets

    • Target

      PassatHook.exe

    • Size

      14.7MB

    • MD5

      eafb67ed7734f5561c709b64e6e36b8f

    • SHA1

      d7d5859993759ef0079a92506a9eed6a11fbdf48

    • SHA256

      1c1e61fa3ca755e7f1616263bcf948ce2a22ae9d01dac95d4093f59ec5e42ce3

    • SHA512

      f152eab4c9b4d80ccfb9d9aea316838ea2f10376d681b1371dee02484fa68e8949a05c5fd6536f21939f036bd70cc179e364099d59f3aa3645bb8534b8f2c692

    • SSDEEP

      393216:l++AaWnPOESRAc5OKC4JLXH9ip87knYOwPecB:HtQtgk4JrYp8gYOUf

    Score
    10/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomwaretrojan

    • Modifies WinLogon for persistence

      persistence

    • UAC bypass

      defense_evasiontrojan

    • Disables RegEdit via registry modification

      defense_evasion

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies WinLogon

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Winlogon Helper DLL

2
T1547.004

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

5
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

3
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Defacement

1
T1491

Tasks