Overview

overview

10

Static

static

10

UbisoftCon...er.exe

windows11-21h2-x64

7

$PLUGINSDI...ol.dll

windows11-21h2-x64

5

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ay.dll

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ry.dll

windows11-21h2-x64

3

Microsoft....ns.dll

windows11-21h2-x64

1

UbisoftConnect.exe

windows11-21h2-x64

9

UbisoftExtension.exe

windows11-21h2-x64

5

UbisoftGam...er.exe

windows11-21h2-x64

3

UbisoftGam...64.exe

windows11-21h2-x64

1

Uninstall.exe

windows11-21h2-x64

4

UplayCrash...er.exe

windows11-21h2-x64

5

UplayService.exe

windows11-21h2-x64

5

UplayWebCore.exe

windows11-21h2-x64

3

chrome_elf.dll

windows11-21h2-x64

3

discord-rpc.x64.dll

windows11-21h2-x64

1

discord-rpc.x86.dll

windows11-21h2-x64

3

gear_core_...LL.dll

windows11-21h2-x64

3

gear_detec...LL.dll

windows11-21h2-x64

3

gpudatabase_win32.dll

windows11-21h2-x64

1

libEGL.dll

windows11-21h2-x64

3

libGLESv2.dll

windows11-21h2-x64

3

libUbiCustomEvent.dll

windows11-21h2-x64

3

libcef.dll

windows11-21h2-x64

3

npuplaypc.dll

windows11-21h2-x64

3

npuplaypchub.dll

windows11-21h2-x64

3

overlay.dll

windows11-21h2-x64

3

overlay64.dll

windows11-21h2-x64

1

shareplay/Qt5Core.dll

windows11-21h2-x64

1

shareplay/Qt5Gui.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    UbisoftConnectInstaller.exe
  • Size 248.4MB
  • Sample251224-n17kcsby3c
  • SHA256 9553eed5c7ccd78596656a5bffef6d8c2422fcc427e2a72fdf8598ec1f849101
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
egregoradwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojanupx

Malware Config

Targets

    • Target
      UbisoftConnectInstaller.exe
    • Size 248.4MB
    • SHA256 9553eed5c7ccd78596656a5bffef6d8c2422fcc427e2a72fdf8598ec1f849101
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan

    • Stops running service(s)

      defense_evasionexecution

    • Adds Run key to start application

      persistence

    • Downloads MZ/PE file

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Modifies Windows Firewall

      defense_evasion

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    • Enumerates processes with tasklist

      discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1
    • Target
      $PLUGINSDIR/AccessControl.dll
    • Size 8KB
    • SHA256 ccc6aaf1071d9077475b574d9bf1fc23de40a06547fc90cf4255a44d3bf631ac
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discoveryupx

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral2
    • Target
      $PLUGINSDIR/LangDLL.dll
    • Size 5KB
    • SHA256 20e642707ef82852bcf153254cb94b629b93ee89a8e8a03f838eef6cbb493319
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 6950991102462d84fdc0e3b0ae30c95af8c192f77ce3d78e8d54e6b22f7c09ba
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/nsArray.dll
    • Size 12KB
    • SHA256 216d68d3f0b37bb2203b3a438a84a089e8c388608f46377ad7e7d6a2709cf9b0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 c5ba017732597a82f695b084d1aa7fe3b356168cc66105b9392a9c5b06be5188
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral6
    • Target
      $PLUGINSDIR/registry.dll
    • Size 24KB
    • SHA256 0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral7
    • Target
      Microsoft.Gaming.XboxApp.Extensions.winmd
    • Size 11KB
    • SHA256 fc57cb27b2d5402d753b25ebc618c7274b8ecf081871527ef2f886e098f06936
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral8
    • Target
      UbisoftConnect.exe
    • Size 507KB
    • SHA256 00fc8c79dcbc8b40005c5ed26ebb30db18a41c7bf63ea598b3635cf4dfa88312
    • MD5 SHA1 SHA512 SSDEEP
    Score
    9/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

    • Renames multiple (115) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Deletes itself

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral9
    • Target
      UbisoftExtension.exe
    • Size 10.2MB
    • SHA256 b66d3d47584b77fb1222644d9a38b46a1c8d961c3babd49be4f1cffee671d3bc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral10
    • Target
      UbisoftGameLauncher.exe
    • Size 2.7MB
    • SHA256 46849e7b776de4478ffe6f2d2ebb0f2ccb74748d8e1bc80e45ea3c1e613e6db0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral11
    • Target
      UbisoftGameLauncher64.exe
    • Size 4.5MB
    • SHA256 e5ceacd412d993424ede28c8ce1551b7bd760e1193dfb166e958e9a30fbbde70
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      Uninstall.exe
    • Size 285KB
    • SHA256 53112f8ebcd1d045bdec69ff941fc156a4d1a8983a6042f97fb912ef044d7298
    • MD5 SHA1 SHA512 SSDEEP
    Score
    4/10
    discovery
    behavioral13
    • Target
      UplayCrashReporter.exe
    • Size 6.3MB
    • SHA256 9f0f7326537a1a05a16b3976a1a1a792a3dfa280e981c927f54af99257e28131
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral14
    • Target
      UplayService.exe
    • Size 7.3MB
    • SHA256 ca5b6374c699c6ec3cd8722f758199ae54b066784c180c499752dda6fab3db5d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10
    discovery

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral15
    • Target
      UplayWebCore.exe
    • Size 2.1MB
    • SHA256 09f59b6d770a3c960136a467bee6dc10d0684959b94ce4d3cd58a6fca18bc5af
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral16
    • Target
      chrome_elf.dll
    • Size 989KB
    • SHA256 3664d7f66defd974fc5ddecbade9c2937698874edfb30ea1d54b069363be3b37
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral17
    • Target
      discord-rpc.x64.dll
    • Size 1022KB
    • SHA256 5cbf32fa5562ddf9f9a318e5ef9b2f5042288ef64c134c520b4a52303d41b61f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral18
    • Target
      discord-rpc.x86.dll
    • Size 771KB
    • SHA256 ac23483e86fe8fdbfe6d0410f0bd57b8efe910a0a047059e454f319f585186a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral19
    • Target
      gear_core_win32DLL.dll
    • Size 1.0MB
    • SHA256 17bf5076aa5334a89b9f08945fc220517cb7d9386c29ebdb359da219aedd3822
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral20
    • Target
      gear_detection_win32DLL.dll
    • Size 755KB
    • SHA256 0b6ea19ec04f5ac555a914f653e4ba21d268926d22db674a7874f926a41917fe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral21
    • Target
      gpudatabase_win32.dll
    • Size 155KB
    • SHA256 518a8d85e6e1e496bd5f1440678c65bcc4b8b9b6503564069df5d0edf3176ccf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral22
    • Target
      libEGL.dll
    • Size 359KB
    • SHA256 e52afc9341b4e1e44f3450f32a58ee2ddbf8ef6a8da275ed37bc2790967440e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral23
    • Target
      libGLESv2.dll
    • Size 5.3MB
    • SHA256 439003c407d478c971cf5a7f22cdb0cb6a5e1f8cfb91ad79bca711ea7aac4b06
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral24
    • Target
      libUbiCustomEvent.dll
    • Size 52KB
    • SHA256 06b115578324609222c8ab909d564c1b2e223aedb85853f8b88e813565842a90
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral25
    • Target
      libcef.dll
    • Size 143.6MB
    • SHA256 8f65fc654e051b79d873f7936c2f57470a4b4f36c81d9daaa0b7f8638aec8ec3
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral26
    • Target
      npuplaypc.dll
    • Size 173KB
    • SHA256 891f9b31c50c1bd709e00e3a388eb4a0501244913245837f367ab2240ad3ef8f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral27
    • Target
      npuplaypchub.dll
    • Size 173KB
    • SHA256 71d723cd5ae8d29134d44f77e656f1092e62b19ee4775a92cf3ee2b76cb763e6
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral28
    • Target
      overlay.dll
    • Size 6.9MB
    • SHA256 b83183a8414498bf9bab9d2ed8b47fe169e6369a262da4fa18965ccc96b676ab
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral29
    • Target
      overlay64.dll
    • Size 8.6MB
    • SHA256 f64f9a729698b55509fd68b2c80adbe0b13b59d2e2895effd15db148d4085ffd
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral30
    • Target
      shareplay/Qt5Core.dll
    • Size 5.9MB
    • SHA256 1e96f5193ab2a2a8dd30c8a887c94fcb56a9346b5a1a2364c3296d153746c464
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31
    • Target
      shareplay/Qt5Gui.dll
    • Size 6.8MB
    • SHA256 570d73aef50807468c1701a9a3b8c7980d01b732f2eed63caf83972f03adb077
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

3
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Service Discovery

1
T1046

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Process Discovery

1
T1057

Query Registry

4
T1012

System Information Discovery

5
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

upxegregor
Score
10/10

behavioral1

adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojan
Score
7/10

behavioral2

discoveryupx
Score
5/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

Score
1/10

behavioral9

defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan
Score
9/10

behavioral10

discovery
Score
5/10

behavioral11

discovery
Score
3/10

behavioral12

Score
1/10

behavioral13

discovery
Score
4/10

behavioral14

discovery
Score
5/10

behavioral15

discovery
Score
5/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

Score
1/10

behavioral19

discovery
Score
3/10

behavioral20

discovery
Score
3/10

behavioral21

discovery
Score
3/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10