General
- Target Watchman_1.0.4_x64-setup.exe
- Size 7.2MB
- Sample260702-st9tcsd15l
- SHA256 0d1f4c2a83bf64d0feeafd998ffc40b606b74ee0c915c5e992341fa3d57b461c
Malware Config
Targets
-
- Target Watchman_1.0.4_x64-setup.exe
- Size 7.2MB
- SHA256 0d1f4c2a83bf64d0feeafd998ffc40b606b74ee0c915c5e992341fa3d57b461c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis_tauri_utils.dll
- Size 33KB
- SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target scripts/temperature_probe.ps1
- Size 3KB
- SHA256 717383eb1b30c4b04fe2b514b4223e7c9f2d00d07226d5fc2dd4617cd80da66d
Score3/10 -
- Target vendor/libre-hardware-monitor/Aga.Controls.dll
- Size 142KB
- SHA256 e9f4eb385359a6d51fcf88153c597e3d75b6e64d5f1c3766eaa2deee739e855f
Score1/10 -
- Target vendor/libre-hardware-monitor/BlackSharp.Core.dll
- Size 32KB
- SHA256 cafb93afcc8d8a367e21f619673d05c06887d8964867fed1371f02ded1cd3e23
Score1/10 -
- Target vendor/libre-hardware-monitor/DiskInfoToolkit.dll
- Size 882KB
- SHA256 1acbf51b3c10c51c986cf43021680d34a2e38d9a5ba652bcfa9a1b5f7fc09800
Score1/10 -
- Target vendor/libre-hardware-monitor/HidSharp.dll
- Size 256KB
- SHA256 d86690efde30ea9179f669320f39148853793b743a98b531afeaf30598e22f54
Score1/10 -
- Target vendor/libre-hardware-monitor/LibreHardwareMonitorLib.dll
- Size 1.1MB
- SHA256 6ebc194316536ba61af5be24508ad9fcbb2ecc685e716c12e787c79530f66bf0
Score1/10 -
- Target vendor/libre-hardware-monitor/Microsoft.Bcl.AsyncInterfaces.dll
- Size 27KB
- SHA256 bda069b17261a50f36b3a79a88b0243d7b9f6508725598adf88d42471977720e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vendor/libre-hardware-monitor/Microsoft.Bcl.HashCode.dll
- Size 26KB
- SHA256 3a4e851ee5fc0f6182aa5a3d65dc56fcd6979b65334b5c3b92fbdc791457c0ab
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target vendor/libre-hardware-monitor/Microsoft.Win32.TaskScheduler.dll
- Size 325KB
- SHA256 5e64f2b0912f3fd60d62c4907229033ef22a349791843c0a0e748b3260e3fcae
Score1/10 -
- Target vendor/libre-hardware-monitor/OxyPlot.WindowsForms.dll
- Size 32KB
- SHA256 0758b8a4c129730e4585e717d4183d48b1167a78e4955ce704d9e6cc204148b2
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2