Extracted

Extracted

• • Target
    package/bin/install_media_pack.ps1
  • Size 174B
  • SHA256 bc20f049badf021e3a53bdb4156603caa5ef482c9a9a251f927605e676a44171
  • MD5 2a146947dd4557b767f82a883762c242
  • SHA1 3725becc11c8c257f093d0a5125234b4feb71510
  • SHA512 e36277d221a4790bfe09f825a5786ae8b801da31891e49a9a038fd5f1f332258231f7f13aaa704059a43e0d7e8a693c52a76a7393d431757f510b08dba828c59
  • TLSH
    T1ABC0CC008382C0FA220A8233A2BC8B82FF8200280F00C8208A88020EFCC280283330EF
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    package/bin/install_webkit_wsl.ps1
  • Size 1KB
  • SHA256 bc61beda37a808eef27d39ce684baa792f6d17737a25a432b1a84d3b591ab815
  • MD5 33c38d9ed738bd836d6ac4d906e4451b
  • SHA1 d997bfe522526d6685f35b6401569e9389eef8b9
  • SHA512 3e892214ffdbba82da2fbc07319c068a10afd08c7b20a14b9078a057a6ff364c9aeeb5a7e503d4412642359bc9695eee175f4893f4c5fa131c0fd82eca84e26b
  • TLSH
    T11B31ABB1988067BA1DE3C587E256C630BCE2C119156022682497CF42BB8F5BECB32D1B
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  executionpersistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    package/bin/reinstall_chrome_beta_linux.sh
  • Size 1KB
  • SHA256 dc8c22b9dde76583cece2857575b88094299615f3136a3c598149710c45dee3a
  • MD5 ff1de5138a4edf3b1ba509fc732ff64d
  • SHA1 00669e5137cb5581b4e5e0c1a917de4f46f46665
  • SHA512 d9e32e8f50fd5d6696cc4846e01118faed42bc7f0bf22f9a45b14060f5d63db56b6e0bf2ff36652d6623a333331ff365c7328da6c8ef81ad64a4a57cdd8ef15c
  • TLSH
    T1D521244B322013BEF41956A2E02A51597A17943F543C7DBE709B0C5CA57F998A07B383
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  defense_evasiondiscoveryexecutionantivm
  behavioral5behavioral6behavioral7behavioral8
• • Target
    package/bin/reinstall_chrome_beta_mac.sh
  • Size 563B
  • SHA256 a92eaeb4ebcf5633a4e9c981481e14c80764fc81b6fcbc0565398e50ff319433
  • MD5 e5dbc3bc16db55572f02ae2a5552b593
  • SHA1 3a45dd0c4f9c78ba10fe73baf172ee7e34723313
  • SHA512 1f7e8eea9ec3e013fa8e901196a3499db22a31b96a93f8b5dc87d51859f0aea2dad2026a4970849c5402880cd3d0beeafd5a059e740668647545b82bb0ee2ab7
  • TLSH
    T18BF0B4E7B44112DF6747CD1B324295A56EB0CB98AB89218BA45E19B2C0CD81E522DA8F
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  antivmdiscovery
  behavioral10behavioral11behavioral12behavioral9
• • Target
    package/bin/reinstall_chrome_beta_win.ps1
  • Size 957B
  • SHA256 b6d9e44742feafb98d5edc56fa20042949973cf30d141a1c5b4fb384096967c5
  • MD5 c205c199bdc830f7c6e94526d3e7ee6c
  • SHA1 3bc4458701cb6883df5ae7876f3e0157367f19be
  • SHA512 71afbd10e296a944bffecfbda9019e65d2f64288f8f6c373fa8ca6bbf34c0a3b120c08a5f9410f015b2f437a22a826394d75e5041111935d89e64038e45b6489
  • TLSH
    T1EE11B113D5A666EFA2A0530768CD9E447E86083B948C9E16728B4008D68573945F8FB3
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral13behavioral14
• • Target
    package/bin/reinstall_chrome_stable_linux.sh
  • Size 1KB
  • SHA256 dc72ab3567a4ce43bd8353d4ecf41f1d9c03e870169367cd3ed9043aabf67dd1
  • MD5 35e953fdb6d3577c06cef292d043ba52
  • SHA1 46533431534084c2d5e3758b8d960e09ce366f2f
  • SHA512 b096ca698b75aca2b6a70519ab92905fb321669709b3aaf4ac3ea2b62a62d3ccc68ced8083d16bac5ca37ab57bfee5372efa9ecbb277fc30bed95fc8fc3b70b8
  • TLSH
    T1D821774B330023BFB41846A2C01265987A13403E042CBEBEB46B082CA9AF955E07F783
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  defense_evasiondiscoveryexecutionantivm
  behavioral15behavioral16behavioral17behavioral18
• • Target
    package/bin/reinstall_chrome_stable_mac.sh
  • Size 519B
  • SHA256 bb43a96c192a6cc81524ade0264686fff7809c019a89f7db0a9849635879c3be
  • MD5 075a544e5d01435c9416a1276b2b01cc
  • SHA1 18fd186450dd91a537357dcf8c365c5f5c496fd9
  • SHA512 56ba888e63becd406a9a10369fc3e2928c0a77cb4fafbbedd659da61c35c6faba2f822ac753570c6fc6997f00243d306e9b93dac2f4b879ff88b66a57f87cf4b
  • TLSH
    T155F0E9DFF94012DF6747CD1A720494157E70CD38EB8920ABA4591593C08D80E565D3CF
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  antivmdiscovery
  behavioral19behavioral20behavioral21behavioral22
• • Target
    package/bin/reinstall_chrome_stable_win.ps1
  • Size 923B
  • SHA256 3d96c4e2f4ebbb3fad44cf3ba58d9cf90af1c9fb3073e3b27d45a74cf005515b
  • MD5 740c933beb08bd9e2bad36193044bef8
  • SHA1 fde73d2022a5edf1572fd75b9c22d6b4c3ac6dbf
  • SHA512 2e85e8a40d42457ad6cc53b4d030efcd56c25e9ddbd72a6a172f9ef35b9aa9abbcf70249b302fdbac63be1dd4e8dcc7843ca7d7daddc109e63c3ef52f5c9679a
  • TLSH
    T1CE110413D1A56AFFB2A4530768CD9E45BED6083BD98C9D26728B000CD68972845F4FF3
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral23behavioral24
• • Target
    package/bin/reinstall_msedge_beta_linux.sh
  • Size 1KB
  • SHA256 10b26f35dbc2000b94edf1172d803a29c5873a4eb8d523afbc687997b642767e
  • MD5 f1d407464923b4c1c448e9e8fb3837d8
  • SHA1 127c0c33f6c26ea91061f3bb45027f2f1ec0e7d1
  • SHA512 6fe5b034417ce366d37bce6d2bef2cdd2ea76a06cad4bfb09d7f9e001fbf58211ee5940029423b61e9273389b874fc3c28162fa0d8a42567e5db17d8965d5d9d
  • TLSH
    T1BE317717E1101376AE2063A2920FC6C1364D923B9430EEEC60FF1424556FEE8D673613
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  credential_accessdefense_evasiondiscoveryexecutionantivm

  • Executes dropped EXE

  • OS Credential Dumping

    Adversaries may attempt to dump credentials to use it in password cracking.

    credential_access

  • Deletes log files

    Deletes log files on the system.

    defense_evasion
  behavioral25behavioral26behavioral27behavioral28
• • Target
    package/bin/reinstall_msedge_beta_mac.sh
  • Size 377B
  • SHA256 0036d738bc90d686100d81f328ba0003bf07863f5500b792c8da391d149750fa
  • MD5 d1ec9a6f58ab66b06e8db70c8f4d9984
  • SHA1 6f1c10c092655535f13d3513d29485ff6af9d6d5
  • SHA512 62f44fc2e5c08a7b9da8134faa2aa3e9ba30e3648484286fa5c3087ebc2559c650c0a76b5fb4676ea6c3c5cb941411a02f7499734591e0e570d72adcad24f0d0
  • TLSH
    T1D4E061555EB150D7DE630F1F96DF80603375E785C650BB7E004D0970D4135AD940680E
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  antivmdiscovery
  behavioral29behavioral30behavioral31behavioral32