Overview

overview

8

Static

static

3

Portable10...n).cmd

windows10-2004-x64

8

Portable10...n).cmd

windows11-ltsc_2024-x64

8

Portable10...co.exe

windows10-2004-x64

8

Portable10...co.exe

windows11-ltsc_2024-x64

8

Portable10...r2.dll

windows10-2004-x64

1

Portable10...r2.dll

windows11-ltsc_2024-x64

1

Portable10...DI.exe

windows10-2004-x64

8

Portable10...DI.exe

windows11-ltsc_2024-x64

8

Portable10...rk.cmd

windows10-2004-x64

8

Portable10...rk.cmd

windows11-ltsc_2024-x64

8

Portable10...en.cmd

windows10-2004-x64

3

Portable10...en.cmd

windows11-ltsc_2024-x64

3

Portable10...sk.cmd

windows10-2004-x64

3

Portable10...sk.cmd

windows11-ltsc_2024-x64

3

Portable10...rk.cmd

windows10-2004-x64

3

Portable10...rk.cmd

windows11-ltsc_2024-x64

3

Portable10...ib.dll

windows10-2004-x64

1

Portable10...ib.dll

windows11-ltsc_2024-x64

1

Portable10...rt.dll

windows10-2004-x64

1

Portable10...rt.dll

windows11-ltsc_2024-x64

1

Portable10...rt.sys

windows10-2004-x64

3

Portable10...rt.sys

windows11-ltsc_2024-x64

3

Portable10...ll.cmd

windows10-2004-x64

3

Portable10...ll.cmd

windows11-ltsc_2024-x64

3

Portable10...er.cmd

windows10-2004-x64

3

Portable10...er.cmd

windows11-ltsc_2024-x64

3

Portable10....0.exe

windows10-2004-x64

8

Portable10....0.exe

windows11-ltsc_2024-x64

8

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows11-ltsc_2024-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    p.rar
  • Size 3.8MB
  • Sample260724-petxtaga29
  • SHA256 48177ecc372e904a4b1abee0f9c33074da58fec7b838c074afec4dbe208fd1a6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Targets

    • Target
      Portable10.1.7/Auto (Run as Admin).cmd
    • Size 365B
    • SHA256 7339a4cc48220a161fcc737ed26e99e5678a4d1faa3f7e2686c46b5a5d234828
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecutionpersistence
    behavioral1behavioral2
    • Target
      Portable10.1.7/AutoPico.exe
    • Size 722KB
    • SHA256 c6603d416dfc48894eda35d9a9a8523bdf9823e215ab926783ce6848aa8a62c4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecutionpersistence
    behavioral3behavioral4
    • Target
      Portable10.1.7/DevComponents.DotNetBar2.dll
    • Size 5.2MB
    • SHA256 01976b54c70d0e7ebd2e185e415f1f92689ce02805a0e6ef99c796ded3bb261b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      Portable10.1.7/KMSELDI.exe
    • Size 903KB
    • SHA256 fb01b16f033d19e5533c9e0846c510649eaa5c21321d1a5b9b284ab2655424ca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    persistencedefense_evasion

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Indicator Removal: Clear Persistence

      remove IFEO.

      defense_evasion
    behavioral7behavioral8
    • Target
      Portable10.1.7/RemoveWaterMark.cmd
    • Size 96B
    • SHA256 b991f07494e570a55efa8f93108a277ff110a38a8e4bc9bd47e894e872063ec1
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    defense_evasionexecutionpersistence
    behavioral10behavioral9
    • Target
      Portable10.1.7/Uninstall/EnableSmartScreen.cmd
    • Size 72B
    • SHA256 c46a27e951658bb62d27496245a307713413e22762bab12eda98d15f6a796b88
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral11behavioral12
    • Target
      Portable10.1.7/Uninstall/Remove_ScheduleTask.cmd
    • Size 88B
    • SHA256 8bda0b92e45f9627c20a8c983c11d8fd8e844e632081eca15e66e8f73d3bc551
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    executionpersistence
    behavioral13behavioral14
    • Target
      Portable10.1.7/Uninstall/Restore_Watermark.cmd
    • Size 1KB
    • SHA256 16b4c96db1fa9ba2fdcfb91972d537a7346f1c80daa164bfd9295d45f1c0b520
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral15behavioral16
    • Target
      Portable10.1.7/Vestris.ResourceLib.dll
    • Size 88KB
    • SHA256 392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      Portable10.1.7/WinDivert.dll
    • Size 16KB
    • SHA256 4e7ebed8410c83b73a23185aa94680143da2933305cd6deefe8ec0b51b7ee6f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      Portable10.1.7/WinDivert.sys
    • Size 34KB
    • SHA256 5e23f3ed1d6620c39a644f9879404a22ded86b3b076ec4a898b4b6be244afd64
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral21behavioral22
    • Target
      Portable10.1.7/cert/installAll.cmd
    • Size 175B
    • SHA256 784e531d9e132f24f622b3eb74bec791d2843912a28c25b28a1be09e9e771c9b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral23behavioral24
    • Target
      Portable10.1.7/driver/UnInstallDriver.cmd
    • Size 114B
    • SHA256 d2613d339ff4fa9e8d49866e62385c7b562c6eae14bd72d1567a8795c3157a21
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral25behavioral26
    • Target
      Portable10.1.7/driver/tap-windows-9.21.0.exe
    • Size 220KB
    • SHA256 325222566df55b85eeae5247ec08bbf555bf2bde00d14cb1a8cf323df4a97c03
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryspywaretrojan

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops file in System32 directory

    behavioral27behavioral28
    • Target
      $PLUGINSDIR/InstallOptions.dll
    • Size 14KB
    • SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29behavioral30
    • Target
      $PLUGINSDIR/System.dll
    • Size 11KB
    • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Image File Execution Options Injection

1
T1546.012

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Indicator Removal

1
T1070

Clear Persistence

1
T1070.009

Modify Registry

2
T1112

Subvert Trust Controls

2
T1553

Install Root Certificate

1
T1553.004

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

3
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

installer
Score
3/10

behavioral1

defense_evasionexecutionpersistence
Score
8/10

behavioral2

defense_evasionexecutionpersistence
Score
8/10

behavioral3

defense_evasionexecutionpersistence
Score
8/10

behavioral4

defense_evasionpersistence
Score
8/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

persistence
Score
8/10

behavioral8

defense_evasionpersistence
Score
8/10

behavioral9

defense_evasionexecutionpersistence
Score
8/10

behavioral10

defense_evasionexecutionpersistence
Score
8/10

behavioral11

execution
Score
3/10

behavioral12

execution
Score
3/10

behavioral13

executionpersistence
Score
3/10

behavioral14

executionpersistence
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

execution
Score
3/10

behavioral27

defense_evasiondiscoveryspywaretrojan
Score
8/10

behavioral28

discovery
Score
8/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

discovery
Score
3/10