Overview

overview

8

Static

static

7

MicrosoftTeams.exe

windows10-2004-x64

8

MicrosoftTeams.exe

windows11-21h2-x64

8

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDI...LL.dll

windows11-21h2-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows11-21h2-x64

3

$PLUGINSDI...FC.dll

windows10-2004-x64

3

$PLUGINSDI...FC.dll

windows11-21h2-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...SC.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows11-21h2-x64

3

$PLUGINSDIR/nsSCM.dll

windows10-2004-x64

3

$PLUGINSDIR/nsSCM.dll

windows11-21h2-x64

3

$PLUGINSDI...ML.dll

windows10-2004-x64

3

$PLUGINSDI...ML.dll

windows11-21h2-x64

3

AxInterop....ib.dll

windows10-2004-x64

1

AxInterop....ib.dll

windows11-21h2-x64

1

AxInterop.ViewerX.dll

windows10-2004-x64

1

AxInterop.ViewerX.dll

windows11-21h2-x64

1

CagService.exe

windows10-2004-x64

1

CagService.exe

windows11-21h2-x64

1

Common.dll

windows10-2004-x64

1

Common.dll

windows11-21h2-x64

1

Core.XmlSe...rs.dll

windows10-2004-x64

1

Core.XmlSe...rs.dll

windows11-21h2-x64

1

Core.dll

windows10-2004-x64

1

Core.dll

windows11-21h2-x64

1

CsExec.Service.exe

windows10-2004-x64

1

CsExec.Service.exe

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    MicrosoftTeams.exe
  • Size 10.5MB
  • Sample260223-sjmabahs3e
  • SHA256 762e09625e5b3f1a49c30ce737dfd97ac8a6b1619e3d9768ec27076d3a3ed012
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationratspywaretrojan

Malware Config

Targets

    • Target
      MicrosoftTeams.exe
    • Size 10.5MB
    • SHA256 762e09625e5b3f1a49c30ce737dfd97ac8a6b1619e3d9768ec27076d3a3ed012
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Adds Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Modifies Windows Firewall

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2
    • Target
      $PLUGINSDIR/FindProcDLL.dll
    • Size 31KB
    • SHA256 a6122e80f1c51dc72770b4f56c7c482f7a9571143fbf83b19c4d141d0cb19294
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 14KB
    • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/SimpleFC.dll
    • Size 175KB
    • SHA256 11ccded83aff463fb6f754ae4145efac64c9238917ab9a35045a67e4fdb39154
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/SimpleSC.dll
    • Size 61KB
    • SHA256 e0c580bbe48a483075c21277c6e0f23f3cbd6ce3eb2ccd3bf48cf68f05628f43
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/nsSCM.dll
    • Size 5KB
    • SHA256 0b96456e8cf6b3e582388d3e530c73ce9121974381d51e5a21cd945c75fd2a38
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/nsisXML.dll
    • Size 11KB
    • SHA256 c40ef0b41c035b6d29656616ddc113a717bfd1bb78c9fcac75d7b6eefdc7bf83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral17behavioral18
    • Target
      AxInterop.MSTSCLib.dll
    • Size 240KB
    • SHA256 f041747b5b6b20b6620ca13a7b276c9e9070e54cda8c29f6add54cba9a42a2f5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      AxInterop.ViewerX.dll
    • Size 40KB
    • SHA256 c6e5f17b2bc91202a1c6a9f3f0547cd7f208368b4cfebb53f234a55f87c5acd5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      CagService.exe
    • Size 19KB
    • SHA256 eb209f6eccdebca405183de5f24ef34ee8c850615e6ab9f086f5a4fb6851e071
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      Common.dll
    • Size 16KB
    • SHA256 74e9ea4521981be2e6f2ed16ac290a7c02edda5a5c9667e73c81f6e26279e19e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      Core.XmlSerializers.dll
    • Size 10.6MB
    • SHA256 eb627549fa4ba8dfedbe22ab7dda5ef750ee29a588ae8760b73ff39f6af3cc1b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      Core.dll
    • Size 2.3MB
    • SHA256 4d47bbb4ff0b6739fb6e069087b6d73b0e2ebc173da9fa47a3a94fcbc506d9f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral29behavioral30
    • Target
      CsExec.Service.exe
    • Size 17KB
    • SHA256 88773a254a7e056a83d6eb7d80b57cc0195cc16bca8317ea35a0576b6a38c639
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Active Setup

1
T1547.014

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

4
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

installerbackdoorrat
Score
7/10

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan
Score
8/10

behavioral2

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan
Score
8/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

discovery
Score
3/10

behavioral7

discovery
Score
3/10

behavioral8

discovery
Score
3/10

behavioral9

discovery
Score
3/10

behavioral10

discovery
Score
3/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

discovery
Score
3/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

discovery
Score
3/10

behavioral17

discovery
Score
3/10

behavioral18

discovery
Score
3/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10