f220fbaada39d3e2889d5a93cfe1fc855cc3962b32d809b31ae4ee4a1a2b1b04

Sharing

Copy URL Twitter E-mail

General

Target
CheatEvolution.zip
Size 13.0MB
Sample260620-txzy1ahs5t
SHA256 f220fbaada39d3e2889d5a93cfe1fc855cc3962b32d809b31ae4ee4a1a2b1b04
MD5 fef659b9066539816b5856682966cc13
SHA1 a8d0338b657cc981102ca81e629dfe31b601c205
SHA512 7660fdeaf140ce8bc60028cbc143c4c0a5110a9f5d88f66bf23f5777021ae19c033e66d8be6e15055dc07bf52085ca150174add409481e4cca5b943c022e2e6c
SSDEEP 196608:aUnKJA2Yj88dz9ub25R9pjHjLDsMpj5pLApi9QFr/qW9ZD8qanmd5zI7qo0uWOd/:aMOYwAzq6RjDpLAmK8Jnmrgl3BqdPS
TLSH
T125D633BB34A3C2E08E63C7621E1BE9D65689018504464FE7D6A705A93C0FFC63978D7E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  CheatEvolution.zip
- Size 13.0MB
- SHA256 f220fbaada39d3e2889d5a93cfe1fc855cc3962b32d809b31ae4ee4a1a2b1b04
- MD5 fef659b9066539816b5856682966cc13
- SHA1 a8d0338b657cc981102ca81e629dfe31b601c205
- SHA512 7660fdeaf140ce8bc60028cbc143c4c0a5110a9f5d88f66bf23f5777021ae19c033e66d8be6e15055dc07bf52085ca150174add409481e4cca5b943c022e2e6c
- SSDEEP 196608:aUnKJA2Yj88dz9ub25R9pjHjLDsMpj5pLApi9QFr/qW9ZD8qanmd5zI7qo0uWOd/:aMOYwAzq6RjDpLAmK8Jnmrgl3BqdPS
- TLSH
  T125D633BB34A3C2E08E63C7621E1BE9D65689018504464FE7D6A705A93C0FFC63978D7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery persistence privilege_escalation spyware
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Modifies system executable filetype association
  persistence
behavioral1
- Target
  CheatEvolution/CheatEvolution.exe
- Size 11.1MB
- SHA256 5d5162db542340f73b7451c2d9138ec714da25483b05344392111c8b0316dbfc
- MD5 e385bf6abe0ddfadfb7e098da559a882
- SHA1 3681f2ec7bbfe2e2d6edab73ea3b108d0d45999d
- SHA512 1f439e28270b49f6c7421bec6dc0f70d14df8d41e43e54a79c037a626df6645b0a6d500c1598c1678cac0e44c0934ab67b02191895f87aed1f8f1cf5c5d0946d
- SSDEEP 196608:6Gn6Hg2U/VbIRN92THpdNV3nTgv9j8p6DQLpx6yfrrUXQLA2iYhPOuw7mV:6WUU/VsRIHQ9j8M6UALA2iwP07m
- TLSH
  T16EC62229B14C33ACC72A857078E7EC06ED61321E08F4959A7ECB3784779A50389FB756
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral2
- Target
  CheatEvolution/DotNetDataCollector32.exe
- Size 161KB
- SHA256 12dfdbec903ce46e0132f239ba4c8e8665b2020ca4aa781dc96a7cd98ed60cf4
- MD5 5ae652ca00afa7378b0fcc6f1a85c137
- SHA1 8720955f40a852e9b5b64fda6ad5b0447c363248
- SHA512 f3858b9c8718c5379b087cfdec37659740d288ed86dc172f592a3e6008bf03907135bcb4ef9449480795893a9d35d87381caf6b5497dc2bead1e8bbc09eae4e7
- SSDEEP 3072:BFdofg4yfkMJ9ftaJMgMhAVhGmmyGrv1RMqIMqsGLOQKs60DYTMgeIe7eT0Z:ndox2VgLCnys1wMZGqdeNZ
- TLSH
  T19CF39C2179C1C833E563083424F4E6BA197DF9311FA89DDFA7854779AE307D19328A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  CheatEvolution/DotNetDataCollector64.exe
- Size 186KB
- SHA256 3a138fda1ec86d8795114d192613414ecc3a1702674c67da3b14ab970acfc211
- MD5 6e4d5643ba06864ca5f9c0598cfa8c41
- SHA1 32a47b05c6f2cf0403a118f130fa62700a6dc97e
- SHA512 c45b7f06256bc2631e9917d636b2de3521f3e817d6fe6fa4ac3bc86fb5ccef408fd0a1a4a376bd80d2ba4fbbaef226d3877555ffb89760e61649f830ba6c49ad
- SSDEEP 3072:PZ9I3HumDI7uSG009IOEMfv+K5SAgH+9gr0zKArFoeeeWA0i:PZ9qBMuSRKDEMX+qC2wti
- TLSH
  T115149D4A73A510F9E22BC53DCD459556E7B3B4420BA49A9F036403BADF633E09F39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  CheatEvolution/Launcher.exe
- Size 1.4MB
- SHA256 8dc6883eb66ca05dbf5cc6c0f98178abf34b848a1c748dba8a8ca4e97c64df87
- MD5 d26ebf669c6736fa7b300b34ec6bf2d2
- SHA1 b5232029e3dee01a9b4c935d341cb0b952473500
- SHA512 0f58f1b9c93453002720aaec4aca545d85bc4871cd165f0c07df42904c6ea242aa51846a82edbe3d11e1b6c78379b805f05100787abfcc1b687e2290f0df2452
- SSDEEP 12288:ridXiXyXGDjDeewZgDxbMAMnHxPN2cSosXWApDp0L9MIl4JS:OXiX6G/DrwZgpMbdN2o+pDp03wS
- TLSH
  T1CC652E14A6788931C3F45774B0EF0AA0DE28601D4FC7675B19E6D4E8FC4932B1AF668B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops file in System32 directory
behavioral5
- Target
  CheatEvolution/data/data.dll
- Size 1.3MB
- SHA256 60c16c2fab14b344b8343778dcd6bbfdee3dfe5f83d1ac8d2e50c6877419eee4
- MD5 c11138204609ea63a3e88b4c8c09b035
- SHA1 b0829124f7e275b0f341c6af0fdd3dd5f65667a4
- SHA512 28d9e92498433c1f6ec41893fc17db76d6cb7a1c565461eb6e67eebc2b924dd4aa65486c29874caa9ac5c78f804a8799c7ce1c641dd9f080bf1bf94b58ca208c
- SSDEEP 12288:aHnKY5WcmiyfogSknJbjhrbXBbrxaLsBDJbVQAjXwcasznMbDz43X6dmM:aqY5Wcmi4FJbXdsLsBNRQAjgH
- TLSH
  T1A2557D47B3B941B8D4AB927DCA534B4BE7B175451320ABDF469887A52F03FE21A7E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  CheatEvolution/lua/DotNetInject.lua
- Size 6KB
- SHA256 a3c0a76e8654384dc6896fc73664fdf7f2ed94e95433f34f9668e3e04cb7354e
- MD5 6fecbdcaac54e6f9cf6b5ff07e0d47c5
- SHA1 bb22202c3ecd421ae843822ec4715a72c9891f6c
- SHA512 baea3a88281decad200641df2df5903ee326d59df54349629ac3ed75154322dafe61f8cbebdc21af2f5ac4c639a557ef34cd8a236562779c2b10d3f8b9da96a5
- SSDEEP 192:zuiTTPEYya1gq5jfFEYQt3xB97Yq1fvhEh:ztTzyapAy
- TLSH
  T11BE1BB023FC3B5DD1E50E3DF4C28E0C6F380E943AE36991475D8877B2AA84695A6D72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral7
- Target
  CheatEvolution/lua/DotNetInterface.lua
- Size 5KB
- SHA256 dfed591417fdf76524e127bfdb022fa6a32394e3a42303f896b39d441bfa6f8e
- MD5 602ea720e7ce9376d736bc348f3988d2
- SHA1 483699d71387b874b7e21eb0a5b3a237e10f5e82
- SHA512 e72bcb9483eb7b503a5a273efac6891b51e6a379920957a831b26d15e06868b65d4abaed0674c0c004d0a42005d91f2b16924765f60a3dc1ec5e505644a7c8f1
- SSDEEP 96:c/miSCXPgMTbTgvp0gh3g60goqZrLLKqQhq0qhRPyvdFO41+/gSrlaYfsm7:4miffgMzgKgh3g60goArLLKqQE0qn6v6
- TLSH
  T1A8B1DD5C5A9A20C326FEC375AB475890E2631042233717D5BF584CA2FB24A7CB5DDBD4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral8
- Target
  CheatEvolution/lua/additional_settings.lua
- Size 426B
- SHA256 a0343d322f042622040d129c7b5d9f9b4cd10e0ee3b249f280b9da7c1f7c0222
- MD5 1f73e4d6e1a5c6eb97b31813ec21d0db
- SHA1 2b7be02d9a14c3141dcc1a147928cc617e198ebc
- SHA512 570f8228f08cda9514d548ef2b6602be677cf03886c2c33cb46e2bde1c74ead077dd6282742bf8bbfaa2b9ef51dec931270e268b4d2520ba273c1a1778da8871
- TLSH
  T166E02B90368391A51BF0D379CC8B7403F245A78301AE0028799E06917FB07DCA2F4E51
- MD5 SHA1 SHA512 TLSH
Score

3^/10
behavioral9
- Target
  CheatEvolution/lua/dlls/DotNetInterface.dll
- Size 8KB
- SHA256 4eafac874d7a3e9d1ff72e1810d9b1828f0a99a429290d739246786fa7939e66
- MD5 5b12656d94b4bbb14c7c59d2c34c3c0b
- SHA1 b6ccc3bbd82456b83ee01c0b4f44b847b401f494
- SHA512 77c9fd0aa9f6f2e4a3109e85f6b2062e5fbd4ec8942dbcd62907742273c1dce691d0de1992d3e41d2ed54e38b3d98fee10af8b7b3d84220d88da4b1225c644a4
- SSDEEP 192:41OcJck67k4zua8M6hahFz/V49eTVTcl:gOcJck6747FhaV49ehTcl
- TLSH
  T18E02FA09EB948717E0AE097894F203110774F329B483DB5F0DC555A35C677A81FA2BBB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  CheatEvolution/lua/dlls/MonoDataCollector32.dll
- Size 378KB
- SHA256 484d2d7eeb49a538162467819b4262aeea1eb45dfea92796520f93e421ecf20d
- MD5 36a5efb2e73e652216c58d7cf8402748
- SHA1 e40926beccd687add6e89c9cb45fef7e73f37ecd
- SHA512 2af5595b489428b5c5403cf2d9bd0845d877cc166b87f1640d729224e740f11141b2606332ffc2ac12d6da8bb5ed7d5636fc5683f5cdafbc8cdb19676ae00e46
- SSDEEP 6144:e0eMHxadZltCtCbvvO4WsD0gWZATaxLqvqzplT4rtwAOag494uZlo69YIT:e4xadXtCEbvvO4WsxsATasvUqrtwwg4l
- TLSH
  T1D6848D1235C2C073E4AF01307864E7555AAEA9314FB9CCEBE7DC262E4E746C25B35A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral11
- Target
  CheatEvolution/lua/dlls/MonoDataCollector64.dll
- Size 505KB
- SHA256 93125bb74fcff6d7c00a8bf28858826badb62add244636296ecf87b5259d239d
- MD5 9f12c94f8b3d5c5c07d6e510ea10fe3a
- SHA1 42003013a194e13f2354183f69bfc77ebe1c8c36
- SHA512 58adcbab27e1e3a9c95c2011f1bd416626dec29ecf6c4bc8e3be189636713e30305dd87a584b26107613520797658af6ac6176263e96ff0f892176a651de8cd8
- SSDEEP 6144:J2IkI+FKFaLmXBKQ3syN8ROOK5lcsfM6/fjyJKfTqP4+R0XHyohfooWgY2efvn+T:clHEQQcyN8RYl6NAyop6gYnmi8D
- TLSH
  T145B47D19B79842B9E067D138C8938A42F7B1740A1B30D7DF43E0967E1F673A15E7AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral12
- Target
  CheatEvolution/lua/dotnetinfo.lua
- Size 53KB
- SHA256 41df4679278eb1b39b872799eb5fd39a166eaad1ac2442ca428c91b90b21a0d5
- MD5 880fdcbd218df2aedb1eaf3be84734b7
- SHA1 3a54200be38433dff112a428aa2c4f2c25ffff1c
- SHA512 e2c7d3a0d3390ef516d12d653d45488e2467b7d3b9621a8ab8d5ef60a2408a16fcb2d51df20d6d79c5af279f56ac4a0be66a48d1051f6dee9378b04175756f74
- SSDEEP 768:uJ28WbCiBJb2C2vGQQmUjdEBtUmEpbGfDW/dWd0WERi/if4AMAbfEUd8tVhfPFg/:geh2v4bpcIRO49tLr0VR2G5cBUam0WEv
- TLSH
  T190332E46355322E791BB826E64CA4C02DB236063D49A2D90BBFC40963F7835CA5FD7BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13
- Target
  CheatEvolution/lua/dotnetsearch.lua
- Size 11KB
- SHA256 dea79bdbda952bbc2e0070c95c7e41d8ce5f9bdb5f18957f31c38b77c31444cb
- MD5 ee8bb6ab0b341b467c918b93fe129822
- SHA1 5fccccb78e5cc1780c86fbddabbb3e58629ba45d
- SHA512 3fd8afcc9ef8de42e3341640c2db7a81261121f6bf0e8e7d8eb01a7a8f957360810c4f82220210978d6ff0dd2a019f528030aa4e22dcb6f50ae48df590e424b7
- SSDEEP 192:f2yeaJbJtCJtJ7lJtJxA3TQmnz3JTiMJADKtDF3zY0PLYcu+herCwthzf12LPNAK:fTJbJcJtJZJtJeJAmDF3zY0PLTuHrRty
- TLSH
  T1674212136910127BB4F3867D6AC37899D622114385871A44BFED90823FB87DDA9F83BD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  CheatEvolution/lua/monoscript.lua
- Size 104KB
- SHA256 61d8d8b8ea43a2651cec2295aa04805e9daf99e3d45890a0bc2c35ede46dcb27
- MD5 cd5bb3f15cb7a9dad2dfcd90b58a8413
- SHA1 d223a680a89c5de611eb374f962e88df8b36b41a
- SHA512 22c7928041c045650c179a1529ec67b3bf0e47ab96289031592c1a4f19bcb322582695d40d0254859df6ec72ee0f3d0c7a5fc690adc62598d082b473c08afe4e
- SSDEEP 768:/smxQLPqWuiXL9eoiK8uthP/xoiEFLWiP8bTg1b3lDWIkCD+JwaS7CIta9HEPsuo:724aRTTwfo6FV23s8DN
- TLSH
  T132A39556241762B69AFBC3746CCF1407F3110053A12A1A19BAECECA63FB526CD1F672D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  CheatEvolution/lua53-32.dll
- Size 439KB
- SHA256 7b4f832fdb72fa75a67c9e035f828de0057dbb5d3c4e9963a9fe596719af0cf9
- MD5 dde3f283f576c0469443f6a59adaca76
- SHA1 aef9a9b07f542eac0dd0012525d12a522bfdb877
- SHA512 d18f8344673a65678dc610ba60493b12b988741569f61e8abcfd80f69b44cdca8da09012c72f6d2476bab6fdd105d10d514a3655bef79cd897fa48e48337a9a0
- SSDEEP 12288:lBj8paX8fQ/T/md4OASZAOLRwRai6wXGn+hfc:lxLrLmd4OA4L8DXGnmc
- TLSH
  T101A4AE12AD52C031D4B8047699B8A5628D3C7E300B3CEDE7A3E958794E742E1F93BB57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  CheatEvolution/lua53-64.dll
- Size 515KB
- SHA256 002dcb8ae68f51d54927b05e4726601640c6ddd6a063cc306640a7245b655f57
- MD5 13100b2466570bf52c48725199c4e3c6
- SHA1 166cc1d388de4d292d4cd9331ef65ee3a158a31e
- SHA512 5e916722673d431417400836e9555148b433a4f9a15e06076ec3eb1c0ba986915c4f4d6940e7f88dcbb2f9599458e14d692bcaaa56dc1e2253005ab295d8589d
- SSDEEP 6144:7shVOadaiL9mUHQMpgL8LgpqClZNKX6SumisBEb/NUidzSky3uDMK/LXTMBQqN5I:TOL9J2L8E5VKKSuLGEhXGstCXoYkc7B6
- TLSH
  T19AB47CA8A6781ABDEC7BD13AC9830917F7B234150B62DADF02E166750F137E2167B314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  CheatEvolution/settings.lua
- Size 10KB
- SHA256 61dfbd223f24536f4311cb124b557c8111c1e62ce6042faefbe65636a1d4556b
- MD5 3c24f79cb4ee296d67aee81a52292ff8
- SHA1 1e2a5e3c47f85a928f32e7f5aa16e32b86c78e4f
- SHA512 a0d041ed65cf6a4216c27d0c7e0b20d483af4cae7ae3403546439f39d0896287f5b3ef3326dbc97a283ca913ce2be58b1dec2e837895d77bfb7d66ef20455643
- SSDEEP 192:3HArrHdkVkyEd8fdtINfbLmFSCEpt9qh0VBv5per1rdKK9E3:3HArcEd8FtIF5dqOpCdhS
- TLSH
  T1EC32305C09920137483E9E572DD6862989C03E2C85C0DAF2B2DE4FDCAFE57688575B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral18
- Target
  CheatEvolution/speedhack-i386.dll
- Size 189KB
- SHA256 2f77a5e845ee6838bfdc73005e748084a79e18ae0e2de4702224041cde78e0ba
- MD5 4acc9d3311fff9d1ac7697010b43f90b
- SHA1 6874d871367bb522c6c6c08b5234b87f1c3e1c69
- SHA512 b842da8bd37a7df85e9776eed956406cbf3b595e23748121170f57e906123ae3b70a561dc28669b19622ff33007830bd8b248b26526ff95a50ff1f897c92bc12
- SSDEEP 3072:ZNyaW1Pg7kFtOp8+vRha0DAyheYn13qaIhRFXOucMEx32zPzIy2G:ZNyal78m8+vRMEe4a4OEOb8G
- TLSH
  T194145C57E6128237CA6B7FB8474A49D12AB4E6103CB1D4DF3DD94E8E5B70B606F28207
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19
- Target
  CheatEvolution/speedhack-x86_64.dll
- Size 245KB
- SHA256 3bd69d00774b40132bd621c09c11093f188f06d634db64a19a78c46a27388c8f
- MD5 156249ce92b9a15d71c39160dc05b4a1
- SHA1 2c2a926456f2c1929fecbe33f9aaf7842d1961a1
- SHA512 5229ca79ca70ecc4e0581bdf1e859a711ca47d4dc226de437dea58fd49a854e80b9368c4d216eb60b0d10b8fa75bb74ce37f8659c0aa59b436fb44570ebcb5d7
- SSDEEP 3072:5ViiO5Ea9m3XJusq4opSm7Im9SC2w/iKhF58jfq65bgusSVIRZOl0vDoD4CfOMst:5VZcWJusRPm7kCdKfkkASX/S
- TLSH
  T120340BAF7512CE7CC0CFCB35488687E19630FE9049F1A74611D0272BDE7AAA46E6C94D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  CheatEvolution/vehdebug-i386.dll
- Size 293KB
- SHA256 9a7e39788bcaac1ea29898f4fdfdcb252785f70d551cf602ad87b77b9a64d6f0
- MD5 e427a09c9df940d8e642679a0742079c
- SHA1 d39d1d47edb20b666a2ffe59a1075639f3a47bde
- SHA512 76870d7482133bce6bf02dcccce46f438c0deb43daffcf440b2d6b7e8e507376c0e6aee262006ad0ec1964630b1c6f62ebfd6850815a24818a94ebdfed8e1382
- SSDEEP 6144:VMek30eIejllI8n1b7nBzwlt/VCWs4zzcwgsaH8E4U:1k30eIkllhxjSlHFzQwgsaHWU
- TLSH
  T1CA546D51E9028337C0EB3AB8564966D406E5DF2038E1C4DB7FCA1F8F6EB19A17E24716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21
- Target
  CheatEvolution/vehdebug-x86_64.dll
- Size 381KB
- SHA256 29866065375542a19c52ff003da0f2a792d8e0816a52cf8d3e193dd4fe005d22
- MD5 fbaf0bf6e47e4026997be3c2f4eb5599
- SHA1 9f4ad4bb186c6c369d9ae36de798358d9b293eb0
- SHA512 cdb25b8c5eacdb1b2b8e0a23a2381efef8d3a41989ec6ee9d1fbae8346a46650d6014191ee4edd6339b3d4ed02b11255e92ff899a748522a50c8baff8f447299
- SSDEEP 3072:0LJQH9j5058zzAKrQCKEIHJ8SS4TnC6ckW3plz9Mu0TVv7Wn2PPsml62TEuGFGLg:0LJQHTfDMCy5HFWsb6eelfQ/gMHCPS4
- TLSH
  T1C884191BF6218A7CC08FCB74549397E29630FE5019F1A78A33C5771B4EB1AB06E6864D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Event Triggered Execution: Component Object Model Hijacking

Modifies system executable filetype association

Downloads MZ/PE file

Checks computer location settings

Drops file in System32 directory

Downloads MZ/PE file

Checks computer location settings

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22