General
- Target c0zes Hard HWID unban.zip
- Size 18.3MB
- Sample260727-dss2wshb24
- SHA256 eb5477a85a77e9605efd76e9f475c51e7a8077bacc247a023e47aa11650342c8
Malware Config
Targets
-
- Target 2/2.exe
- Size 5.1MB
- SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
Score7/10-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
- Target 3/3.exe
- Size 636KB
- SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 4/1.bat
- Size 3.2MB
- SHA256 2fe645bcbe93398f67d06a80607a0bbe3f1441ecdb02b277fd62dd8e2ad99340
Score8/10-
Server Software Component: Terminal Services DLL
-
Disables service(s)
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Stops running service(s)
-
Drops file in System32 directory
-
- Target 4/4.bat
- Size 107KB
- SHA256 00023ce602db623e47de1029595339eec4ee5019c6017236c9b721cac0ae4032
Score3/10 -
- Target 4/Cleaner1.bat
- Size 4KB
- SHA256 ca7dfbc65c1fde66413b5dd06f763cbe6b8be78c2a3b88030ccd5dfac23c07df
Score8/10-
Modifies Windows Firewall
-
- Target 4/Cleaner2.bat
- Size 22KB
- SHA256 6d8474b60f28ee629a8b0eae25cc8c214d2e45c23e64445105389b530b535819
Score3/10 -
- Target 4/Cleaner3.bat
- Size 111KB
- SHA256 317142fae707cbac948083d56b1163aa5a6a1b9270031d9e49ea79214ebe99ef
Score8/10-
Modifies Windows Firewall
-
- Target 4/Cleaner4.bat
- Size 162KB
- SHA256 11699f90d4533162a3b7ad620b61a9745a9a06989c3b93b217cd10dec64fb0ad
Score3/10 -
- Target 4/FortniteCleaner.bat
- Size 1.5MB
- SHA256 365685c1e71944bc955c6be46cc33a44099bcb0f8c625228e89445f18866b778
Score3/10 -
- Target 4/Ghost_cleaner1.bat
- Size 581KB
- SHA256 d1ef552d446eb507fe476872efe18e76e0890198a8deb563e78b22b4c411c439
Score7/10-
Stops running service(s)
-
Drops file in System32 directory
-
- Target 4/Ghost_cleaner2.bat
- Size 265KB
- SHA256 a3c1a9061c4caddfa5023640eb8c33c3c99859320a8c3164e88facba9166bf35
Score7/10-
Stops running service(s)
-
- Target 4/Ghost_cleaner3.bat
- Size 23KB
- SHA256 6a0a081e956bb8570b273e6d88206f047ba415e633d54199ff1f23346f201d9e
Score7/10-
Stops running service(s)
-
- Target 4/Ghost_cleaner4.bat
- Size 106KB
- SHA256 3a146cc094d610615883fbcd72097bdf86b48e9c2bc190ae33458f02b0589b8a
Score7/10-
Stops running service(s)
-
- Target 4/Ghost_cleaner5.bat
- Size 23KB
- SHA256 f70f71900d00f4e3fecf0bb8ba9af0670455a07420893f3f5c3e07a961023aa1
Score9/10-
Clears Windows event logs
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
- Target 4/Ghosts_FortniteCleaner.bat
- Size 1.5MB
- SHA256 fc5a6bbfcbc91ba982f27afcf525eb516515690ed249b5b6a4be861a1411ec5f
Score7/10-
Stops running service(s)
-
- Target 4/Ghosts_Toruney_Cleaner.exe
- Size 135KB
- SHA256 d5b857f4972fea91c9d476905d4fb6f80de89df311da0dce83adfbef4d32d1b3
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Windows Command Shell
1System Services
2Service Execution
2Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1