General
- Target Install-GooglePlayGames.exe
- Size 39.4MB
- Sample260709-djdkvacz9z
- SHA256 2fd9bbcd6ad611bf73693819779f2bdf2ece0b64c095d212dc8183888d32346b
Malware Config
Targets
-
- Target Install-GooglePlayGames.exe
- Size 39.4MB
- SHA256 2fd9bbcd6ad611bf73693819779f2bdf2ece0b64c095d212dc8183888d32346b
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target brandedinstallerlib.dll
- Size 1.5MB
- SHA256 7eb1699a7bb7817e94b87ff86feeb8c8fa3d8d0675b826ded607f6c47ff81e17
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target brandedinstallerlib.pdb
- Size 57KB
- SHA256 e886c0dd86abee1d44de71a2c72b6ffe0f7d16a9b4d28ec553cb5035aae69bb3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target brandedinstallerlib.protos.dll
- Size 130KB
- SHA256 1fc04b47fabed7367251c96e60459279d9e0298dfa2dc1dfd3a1d31146732936
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target brandedinstallerlib.protos.pdb
- Size 52KB
- SHA256 96026578f0cf8f15ec4b94db18d7904f895b2642334b35e25f731fa37961d46d
Score3/10 -
- Target costura.dll
- Size 4KB
- SHA256 7fa146704d6681e2280fc34535239b03f6fcbae46e2af191702f43894ac286cb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target costura.pdb
- Size 2KB
- SHA256 4baa725d931b974ee5756d839085cce8736e1f99d405529f825ffa2d6770f2d4
Score3/10 -
- Target crashreport.dll
- Size 13KB
- SHA256 a6fb4795d9201077a39db261fec598a30282a3453160e0bf355bee10fc566265
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target crashreport.pdb
- Size 10KB
- SHA256 7cc8701e6cae10dbe23088787cb8006ebe7f6fb7c738d706267ab65aa159cbb7
Score3/10 -
- Target feedback.dll
- Size 457KB
- SHA256 9bacaff2610c68b3ada87d639b817769428ba4fac7b275bd9d512e43c832832f
Score1/10 -
- Target feedback.pdb
- Size 23KB
- SHA256 81d8bc4c56071204e20a0545e97608bf6cda2eb9dcf026fa45869e025519b051
Score3/10 -
- Target gateway.dll
- Size 368KB
- SHA256 9deadfaa199ff5fb76661948d4ac5e623a982907ef3630a025a5a1acf8c4eae1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target gateway.pdb
- Size 132KB
- SHA256 a7c7ca36bcd66d7efc98c8f8aadeee51a82e36a5207f66bddccd9464d653f545
Score3/10 -
- Target google.protobuf.dll
- Size 485KB
- SHA256 3b1b4190ce28b3bb4c6e7b96e7cf2f64195cf919a2756ab9f7a688bb3dc726aa
Score1/10 -
- Target google.protobuf.pdb
- Size 183KB
- SHA256 d9e3f39c85150a45223c0cc89676e579d7a6697dfab2281f65bba46c29e4f5ff
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target grpc.core.api.dll
- Size 58KB
- SHA256 d13ba6360fa73140cda545afab6f21d6576475f9644cd153c182dde6aede8f80
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1