Overview

overview

10

Static

static

3

print20251...��.bat

windows10-2004-x64

10

print20251...��.bat

windows11-21h2-x64

10

print20251...ET.dll

windows10-2004-x64

1

print20251...ET.dll

windows11-21h2-x64

1

print20251...VC.exe

windows10-2004-x64

6

print20251...VC.exe

windows11-21h2-x64

6

print20251...to.dll

windows10-2004-x64

1

print20251...to.dll

windows11-21h2-x64

1

print20251...on.dll

windows10-2004-x64

1

print20251...on.dll

windows11-21h2-x64

1

print20251...er.dll

windows10-2004-x64

1

print20251...er.dll

windows11-21h2-x64

1

print20251...er.dll

windows10-2004-x64

1

print20251...er.dll

windows11-21h2-x64

1

print20251...VC.exe

windows10-2004-x64

1

print20251...VC.exe

windows11-21h2-x64

1

print20251...ll.bat

windows10-2004-x64

8

print20251...ll.bat

windows11-21h2-x64

8

print20251...rp.dll

windows10-2004-x64

1

print20251...rp.dll

windows11-21h2-x64

1

print20251...es.dll

windows10-2004-x64

1

print20251...es.dll

windows11-21h2-x64

1

print20251...um.dll

windows10-2004-x64

1

print20251...um.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
  • Size 8.6MB
  • Sample260528-v855tsht6l
  • SHA256 dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspywaretrojan

Malware Config

Targets

    • Target
      print20251118/AA-点击这里启动打印程序.bat
    • Size 2KB
    • SHA256 c0a26d9852c08d1eb6ed95e6905740c0c73436d19f128140c3c54ca9dfeeef91
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    defense_evasionpersistenceprivilege_escalationtrojan
    behavioral1behavioral2
    • Target
      print20251118/AutoUpdater.NET.dll
    • Size 410KB
    • SHA256 7fba2526db54ddb6b4bccae1cb0b7becfe9e979951e45dba35395b371980a171
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      print20251118/BLMPrinterSVC.exe
    • Size 101KB
    • SHA256 6fec49e6a3967c60312ec3a4be1cc27d678548e28807ffa72045a7a5624f2c76
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    persistence
    behavioral5behavioral6
    • Target
      print20251118/BouncyCastle.Crypto.dll
    • Size 2.5MB
    • SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      print20251118/Newtonsoft.Json.dll
    • Size 683KB
    • SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      print20251118/PdfiumViewer.dll
    • Size 113KB
    • SHA256 65f1fcbf4a836cf37a0e8ca32badc0fb81b9387014ce141cc05e5da711486ba8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      print20251118/QRCoder.dll
    • Size 150KB
    • SHA256 5ae2792c76262943a4e34140bbd64b2aa7d9ed5c5822680c00d9eaa322412680
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      print20251118/app.publish/BLMPrinterSVC.exe
    • Size 101KB
    • SHA256 0d90f0ae18a6c961500eba6ba3583ff6a89f97a4c8e3d69ca3e9d01e29ba0c7f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      print20251118/fuxin_install.bat
    • Size 999B
    • SHA256 55c8cd5a2a6cb30e278478335106c15de5dbc6edcfc968175bed6943e27a99c4
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspyware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral17behavioral18
    • Target
      print20251118/itextsharp.dll
    • Size 2.5MB
    • SHA256 ce5a107dad43a4101eeb3fe84ff6d173a6d55f34f0bff725b536366f10e99410
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      print20251118/nl/PdfiumViewer.resources.dll
    • Size 4KB
    • SHA256 6426550dab099f55a5973dff404988a44d80d0970aba3f214faee3d3a3a1944e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      print20251118/pdfium.dll
    • Size 13.2MB
    • SHA256 7b5469f3fed2ddb102878457bc486759e029cc5487d429395028a43a15ff1e3b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral2

defense_evasionpersistenceprivilege_escalationtrojan
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

persistence
Score
6/10

behavioral6

persistence
Score
6/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspyware
Score
8/10

behavioral18

adwaredefense_evasiondiscoveryinstallerpersistenceprivilege_escalationspyware
Score
8/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10