Overview

overview

7

Static

static

7

Hone-Installer.exe

windows10-2004-x64

6

Hone-Installer.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ne.dll

windows10-2004-x64

1

$PLUGINSDI...ne.dll

windows11-ltsc_2024-x64

6

$PLUGINSDI...ip.dll

windows10-2004-x64

1

$PLUGINSDI...ip.dll

windows11-ltsc_2024-x64

1

$PLUGINSDIR/INetC.dll

windows10-2004-x64

3

$PLUGINSDIR/INetC.dll

windows11-ltsc_2024-x64

6

$PLUGINSDI...re.dll

windows10-2004-x64

1

$PLUGINSDI...re.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...ms.dll

windows10-2004-x64

1

$PLUGINSDI...ms.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...er.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...on.dll

windows10-2004-x64

1

$PLUGINSDI...on.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...er.exe

windows10-2004-x64

6

$PLUGINSDI...er.exe

windows11-ltsc_2024-x64

6

$PLUGINSDI...ls.dll

windows10-2004-x64

1

$PLUGINSDI...ls.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...en.dll

windows10-2004-x64

1

$PLUGINSDI...en.dll

windows11-ltsc_2024-x64

1

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

6

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...er.dll

windows10-2004-x64

1

$PLUGINSDI...p.html

windows10-2004-x64

3

$PLUGINSDI...p.html

windows11-ltsc_2024-x64

4

$PLUGINSDI...x.html

windows10-2004-x64

3

$PLUGINSDI...x.html

windows11-ltsc_2024-x64

4

$PLUGINSDI...app.js

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Hone-Installer.exe
  • Size 2.9MB
  • Sample260706-srlnracy8l
  • SHA256 4e7510ac8c200bae3d4b63ca37e00564f17b6236a43dfe287bde3c054e734c49
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywaretrojanupx

Malware Config

Targets

    • Target
      Hone-Installer.exe
    • Size 2.9MB
    • SHA256 4e7510ac8c200bae3d4b63ca37e00564f17b6236a43dfe287bde3c054e734c49
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/CommandLine.dll
    • Size 60KB
    • SHA256 569307401b949368527b128155b4e16b349803ec7d65c1052cc23c7b7a1336d8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    adwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral3behavioral4
    • Target
      $PLUGINSDIR/DotNetZip.dll
    • Size 467KB
    • SHA256 6c512d9943a225d686b26fc832589e4c8bef7c4dd0a8bdfd557d5d27fe5bba0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/INetC.dll
    • Size 34KB
    • SHA256 0ecf8b76a413726d2a9c10213ad6e406211330e9e79cfde5024968eedc64a750
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8
    • Target
      $PLUGINSDIR/Microsoft.Web.WebView2.Core.dll
    • Size 557KB
    • SHA256 11e88b2ca921e5c88f64567f11bd83cbc396c10365d40972f3359fcc7965d197
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      $PLUGINSDIR/Microsoft.Web.WebView2.WinForms.dll
    • Size 37KB
    • SHA256 e4f695b72f99024e3ee5d5f26a367e664f4e120bd5d90aa87a8bc0509c365ec8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      $PLUGINSDIR/Microsoft.Win32.TaskScheduler.dll
    • Size 116KB
    • SHA256 0bdad6deb1b651e0a52bab4db2c7883c9332884aa37300b3439c69d85b054c7c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      $PLUGINSDIR/Newtonsoft.Json.dll
    • Size 692KB
    • SHA256 7b44639cbfbc8ddac8c7a3de8ffa97a7460bebb0d54e9ff2e1ccdc3a742c2b13
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      $PLUGINSDIR/OWInstaller.exe
    • Size 336KB
    • SHA256 1cb8b8ec0a4bbe17e1e595482ec071b79366545f0b92d43fd9bb9d7d9314476e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral17behavioral18
    • Target
      $PLUGINSDIR/OverWolf.Client.CommonUtils.dll
    • Size 674KB
    • SHA256 43a581a5c77695a08682fadfef7e8c2e835948a528b98ca832ef25e8ae329c6d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      $PLUGINSDIR/SharpRaven.dll
    • Size 82KB
    • SHA256 776c6b0642f7a3f3f3ad3cc6bb5f1d528e90c6029b671d8f82b0320b185b92a7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      $PLUGINSDIR/System.dll
    • Size 21KB
    • SHA256 4dbc79d2b1c7987cc64bb5d014db81bb5108bdd6d8bf3a5f820fac1ded62be33
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoveryadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral23behavioral24
    • Target
      $PLUGINSDIR/UserInfo.dll
    • Size 14KB
    • SHA256 a27dc3069793535cb64123c27dca8748983d133c8fa5aaddee8cdbc83f16986d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      $PLUGINSDIR/WebView2Loader.dll
    • Size 161KB
    • SHA256 465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      $PLUGINSDIR/app/cmp.html
    • Size 5KB
    • SHA256 5966979a422c2526dd77897fb643639d82b16bdb89d8fa6e8615d3b32169af3c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral28behavioral29
    • Target
      $PLUGINSDIR/app/index.html
    • Size 27KB
    • SHA256 885a8d6b77fedcd26194de2b47db15c8053a8654c29f6ec6d23bc290c1125c0d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral30behavioral31
    • Target
      $PLUGINSDIR/app/js/app.js
    • Size 24KB
    • SHA256 d5e17f9d5ba63d4360c66ad9b5633a0ca3c0f3573f4ddb357aee380ab317bb18
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

JavaScript

1
T1059.007

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

2
T1120

Query Registry

6
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

upx
Score
7/10

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
6/10

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
6/10

behavioral3

Score
1/10

behavioral4

adwarepersistenceransomwarespyware
Score
6/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

discovery
Score
3/10

behavioral8

adwarediscoverypersistenceransomwarespyware
Score
6/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
6/10

behavioral18

defense_evasiondiscoverypersistenceprivilege_escalationtrojan
Score
6/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

adwarediscoverypersistenceransomwarespyware
Score
6/10

behavioral25

discovery
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
4/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
4/10

behavioral32

execution
Score
3/10