General
- Target UT2004.exe
- Size 32.2MB
- Sample260709-refrascv51
- SHA256 1d2edee10c28ea786d3d54b986d17588776ba6154f28474d1c21e3bb2309b39e
Malware Config
Targets
-
- Target UT2004.exe
- Size 32.2MB
- SHA256 1d2edee10c28ea786d3d54b986d17588776ba6154f28474d1c21e3bb2309b39e
Score6/10-
Drops desktop.ini file(s)
-
Network Service Discovery
Attempt to gather information on host's network.
-
- Target $PLUGINSDIR/INetC.dll
- Size 25KB
- SHA256 85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
Score3/10 -
- Target Installer/info/aria2/README.html
- Size 37KB
- SHA256 edcd2c4e4ed1e87b6ca1f4f820f3f078a86561a07fcbe6cc28ffb52c47118e33
Score4/10 -
- Target Installer/install.bat
- Size 92B
- SHA256 2f8342834018758f36461fa8ed434426e549018106766b35bda225adcf8ee1bd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Installer/install.php
- Size 15KB
- SHA256 4104e479f22a2c247cb585c133f01e06c709b041698a73cb184f2895272e1949
Score3/10 -
- Target Installer/redist/VC_redist.x64.exe
- Size 17.7MB
- SHA256 8995548dfffcde7c49987029c764355612ba6850ee09a7b6f0fddc85bdc5c280
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Installer/redist/VC_redist.x86.exe
- Size 6.6MB
- SHA256 e7267c1bdf9237c0b4a28cf027c382b97aa909934f84f1c92d3fb9f04173b33e
Score4/10 -
- Target Installer/redist/dxwebsetup.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
Score6/10-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
- Target Installer/tools/7z.dll
- Size 1.2MB
- SHA256 07f88bae90a4c49e200981445d78683c5ef21ef71bb6927fa7cfd59bca431e80
Score3/10 -
- Target Installer/tools/7z.exe
- Size 339KB
- SHA256 8b9f09e2bcaac9166a0f87525864f29c868f2cb8b779ca6d3d63b93b388d5c89
Score3/10 -
- Target Installer/tools/Core.dll
- Size 768KB
- SHA256 d2b5d2bdf3061b255c0a28d7302cc152079ccbe74ab2c447966f216b1b9ce361
Score3/10 -
- Target Installer/tools/UZ.exe
- Size 80KB
- SHA256 01c554a9a8d685c8dcfdb1b1ba9b2ad30e05855888473e57c4f815badf8765d0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Installer/tools/aria2c.exe
- Size 8.1MB
- SHA256 95fc0aed475fb53e9f1acc29ecfaa9dd7f2ff71ec6be33442818a1507479d728
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1