General
- Target openconnect-gui-1.5.3-win32.exe
- Size 22.6MB
- Sample260707-pg4j2aey6k
- SHA256 b1d4bd76b41f32d08287bf043b3dc8c798a145c02319217d45a74b0d9545a23d
Malware Config
Targets
-
- Target openconnect-gui-1.5.3-win32.exe
- Size 22.6MB
- SHA256 b1d4bd76b41f32d08287bf043b3dc8c798a145c02319217d45a74b0d9545a23d
Score7/10-
Loads dropped DLL
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 e625dcd0188594b1289891b64debddeb5159aca182b83a12675427b320bf7790
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StartMenu.dll
- Size 7KB
- SHA256 30336c7b09582de438d6c3f561f55366dd7094faf24f34e12df44acf19be9242
Score3/10 -
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
Score3/10 -
- Target Drivers/tap-windows.exe
- Size 250KB
- SHA256 645bee92ba4e9f32ddfdd9f8519dc1b9f9ff0b0a8e87e342f08d39da77e499a9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
Score3/10 -
- Target bin/tapinstall.exe
- Size 90KB
- SHA256 c9963a3f8abf6fedc8f983a9655a387d67c752bd59b0d16fd6fc2396b4b4ca67
Score1/10 -
- Target driver/tap0901.sys
- Size 26KB
- SHA256 89c5ca1440df186497ce158eb71c0c6bf570a75b6bc1880eac7c87a0250201c0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Drivers/vcredist_x86.exe
- Size 13.8MB
- SHA256 12a69af8623d70026690ba14139bf3793cc76c865759cad301b207c1793063ed
Score4/10 -
- Target Qt5Core.dll
- Size 5.9MB
- SHA256 2bf9147acad2d66a4fe3e802e8e4fdaf3a35ff1b4a2fd12f7fa9526ee133c58a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt5Gui.dll
- Size 6.1MB
- SHA256 c4d240e81a275da4ef68d59b546cfbf8b231e1bab2696e36668d109f3fd71897
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt5Network.dll
- Size 1.7MB
- SHA256 0fbcc1cc0448ef284b44b26cf8d44ceb386b5b1bee3950aa6b6b4ca246564a61
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt5Widgets.dll
- Size 5.9MB
- SHA256 77059b4fe7121215112ad022150671a63b540a00f4c545921a7fc25cca8be61b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Uninstall.exe
- Size 435KB
- SHA256 76f0260dc0b833ccad670862d7ab6494ac3416959e7a5862b9b2debde1130560
Score7/10-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target $PLUGINSDIR/UserInfo.dll
- Size 4KB
- SHA256 0073337816509851476c2cc154f471a3e3a1a2806b97c363870acc09a30a5ed7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1