General
- Target EzExtractSetup.exe
- Size 4.4MB
- Sample260705-121vesf12v
- SHA256 4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f
Malware Config
Targets
-
- Target EzExtractSetup.exe
- Size 4.4MB
- SHA256 4704846c5605552a2573aeb62f176630fd2ba5498457420c3fb36a27cae6800f
Score5/10-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
Score3/10 -
- Target $PLUGINSDIR/NsisPlugin.dll
- Size 280KB
- SHA256 23abc9395b36419700f31b507f13a189ec2eeb70c7e1a1fe9406c2b9e0728298
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
Score3/10 -
- Target $PLUGINSDIR/chrome_icon.ico
- Size 9KB
- SHA256 fd3fcdbaf646a29845d3bf55aae8671b5722e9c74122a2bfef3c53c88d77b247
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target $PLUGINSDIR/chrome_image.ico
- Size 112KB
- SHA256 d20cd43dff2be4c2604881cd426c1a6b580222f3874539d3efb96ded689aebfb
Score3/10 -
- Target $PLUGINSDIR/gcinst.exe
- Size 1.3MB
- SHA256 5690d7de821e2d10210b6ae5f9a490934bc77a3005ee72c56eed00fea63bf4ce
Score4/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target GoogleUpdateSetup.exe
- Size 1.3MB
- SHA256 027299ea8dfa96e0e59794c59abfd562e2f675e8b8b9a84028da8c58c58d243f
Score4/10 -
- Target $PLUGINSDIR/modern-wizard.bmp
- Size 25KB
- SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
Score1/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
Score3/10 -
- Target EzExtractProCoreDll.dll
- Size 1.9MB
- SHA256 6f9b0b8e8d1efbe25b81b0676a5902ec97aac1bfdc84a1a2d1b58659eb44dc5d
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target EzExtractProShell.dll
- Size 167KB
- SHA256 08ccd848487f570175e3c5b8fa70b04ce30e3afb9f43b4105180e2eb079c85c6
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target EzExtractProShell32.dll
- Size 126KB
- SHA256 2d3a1c7e0e6256344648a054bc5526d4804538fef9cc87efab9edb426bf1f4a6
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1