Overview

overview

8

Static

static

8

winamp_lat...ll.exe

windows10-2004-x64

8

$PLUGINSDI...er.bmp

windows10-2004-x64

1

$PLUGINSDI...rd.bmp

windows10-2004-x64

1

$R0/Bento/...ot.png

windows10-2004-x64

1

$R0/Bento/...e.maki

windows10-2004-x64

3

$R0/Bento/...o.maki

windows10-2004-x64

3

$R0/Bento/...t.maki

windows10-2004-x64

3

$R0/Bento/skin.xml

windows10-2004-x64

3

$R0/Bento/...rt.jpg

windows10-2004-x64

1

$R0/Bento/...ig.png

windows10-2004-x64

1

$R0/Bento/...ls.png

windows10-2004-x64

1

$R0/Bento/...er.png

windows10-2004-x64

1

$R0/Bento/...le.png

windows10-2004-x64

1

$R0/Bento/...lp.png

windows10-2004-x64

1

$R0/Bento/...ns.png

windows10-2004-x64

1

$R0/Bento/...ay.png

windows10-2004-x64

1

$R0/Bento/...ew.png

windows10-2004-x64

1

$R0/Bento/...nt.png

windows10-2004-x64

1

$R0/Bento/...er.png

windows10-2004-x64

1

$R0/Bento/...rt.jpg

windows10-2004-x64

1

$R0/Bento/...rs.png

windows10-2004-x64

1

$R0/Bento/...de.png

windows10-2004-x64

1

$R0/Bento/...ui.png

windows10-2004-x64

1

$R0/Bento/...i2.png

windows10-2004-x64

1

$R0/Bento/...ts.png

windows10-2004-x64

1

$R0/Bento/...ow.png

windows10-2004-x64

1

$R0/Bento/...ig.xml

windows10-2004-x64

3

$R0/Bento/...ts.xml

windows10-2004-x64

3

$R0/Bento/...al.xml

windows10-2004-x64

3

$R0/Bento/...er.xml

windows10-2004-x64

3

$R0/Bento/...ts.xml

windows10-2004-x64

3

$R0/Bento/...up.xml

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    winamp_latest_full.exe
  • Size 12.4MB
  • Sample260730-dzcy9astbx
  • SHA256 fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarerevoked_codesignspywaretrojan

Malware Config

Targets

    • Target
      winamp_latest_full.exe
    • Size 12.4MB
    • SHA256 fa09d24d7481dbdfc1cff6aaa92d2aec908e037a22a02346f6feeee5d6ba688e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1
    • Target
      $PLUGINSDIR/modern-header.bmp
    • Size 25KB
    • SHA256 88e8a05be9cfb8daec31872c8322b7313b66ceaa45c361f8efeda53809f46910
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      $PLUGINSDIR/modern-wizard.bmp
    • Size 150KB
    • SHA256 7ae875cfcb6e3b1f4a06460fbda99d8014dc4674ee256b0b79ec656777c7e292
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      $R0/Bento/screenshot.png
    • Size 21KB
    • SHA256 f6489a024f8a06888d268006c030cd00c9dff3cf8f51101fb3f074920c94ea6a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      $R0/Bento/scripts/mcvcore.maki
    • Size 21KB
    • SHA256 8fc3fb4cb3da92c8b28e60aaee3ae5ba955a8b47250e9a9ab5f44573779eb7ba
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral5
    • Target
      $R0/Bento/scripts/playlistpro.maki
    • Size 12KB
    • SHA256 23bcc0a477bf48a988f935b25f6b0fa089b7df96a09098533fe7d26ad042319e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral6
    • Target
      $R0/Bento/scripts/pledit.maki
    • Size 12KB
    • SHA256 377199c7c20ff8e4448b070b63af1ea5e4ed8da88ae06f473426c8f9dc940551
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7
    • Target
      $R0/Bento/skin.xml
    • Size 1KB
    • SHA256 dfda9ade2616f02efa860f6ee57ad335837a96a788744e97ee345d3235db9a37
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral8
    • Target
      $R0/Bento/window/aol_radio_alb_art.jpg
    • Size 13KB
    • SHA256 d3651051e5b9cc26d5929584dc327aa415ef45785cbec998e4dee64262eb22e1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      $R0/Bento/window/config.png
    • Size 8KB
    • SHA256 c1543cf73ff317c943b74ed0e45795662fba821de35e14dd980c723f696b0d6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      $R0/Bento/window/controls.png
    • Size 7KB
    • SHA256 7c65e61de69ea9fa76d83c97098f00216ee5d28b7424f8aa4d7149972a8bb011
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11
    • Target
      $R0/Bento/window/equalizer.png
    • Size 13KB
    • SHA256 7990287779ec622389e242d91acd5a8dda3da811e55934ac6fd1c656e519bb26
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral12
    • Target
      $R0/Bento/window/menu_file.png
    • Size 144B
    • SHA256 f295ec1e83bd87937eac1dd9a3c3f3da994aae1c64c01e456acbf21667cdb69d
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral13
    • Target
      $R0/Bento/window/menu_help.png
    • Size 149B
    • SHA256 7a2b183c0e1bb096b70f8a0712b40c11c1be3f14c2402315bb4fc992e06725c0
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral14
    • Target
      $R0/Bento/window/menu_options.png
    • Size 167B
    • SHA256 304cb60a23d917999dd26fd2ddb4a2ce97638a83c7ee9755af5fbde1894a88f1
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral15
    • Target
      $R0/Bento/window/menu_play.png
    • Size 145B
    • SHA256 9c77376305b53fca8e08fb5ee45d56bea331ae3ec0a6e79b045dfbde979b87bb
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral16
    • Target
      $R0/Bento/window/menu_view.png
    • Size 155B
    • SHA256 5f85efe10a4d2b1eec6af415c2f4f443ec7944bb913337c262818abc931d92b8
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral17
    • Target
      $R0/Bento/window/numfont.png
    • Size 8KB
    • SHA256 8bb517b55fe912ed4c6400e509fcc53a1b4fda436c2c29de83e9c941bde9170e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral18
    • Target
      $R0/Bento/window/player.png
    • Size 17KB
    • SHA256 7279946f840d0dffc75ad885e552ca1fc6e9060ceb56e162ddcc09bf346f0e6b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19
    • Target
      $R0/Bento/window/sc_alb_art.jpg
    • Size 2KB
    • SHA256 a040fd61d8e87e3162bc93ba5529a22e3a1b7a06645d0e3adb6ece5e96f34303
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral20
    • Target
      $R0/Bento/window/scrollbars.png
    • Size 830B
    • SHA256 f032876fc121b9aaa3bca10ea6e24f1afeae384806c3166a99c26d7df5735da7
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral21
    • Target
      $R0/Bento/window/shade.png
    • Size 3KB
    • SHA256 ff9435b27e1df6b5e6a12e68664dd79bac0512231cb45c11b11400a7e929b19d
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral22
    • Target
      $R0/Bento/window/sui.png
    • Size 4KB
    • SHA256 69d19bd914d535a2122655e703eabb4e02c66cad0fb32892cd3b6a79e21107cd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23
    • Target
      $R0/Bento/window/sui2.png
    • Size 5KB
    • SHA256 65416707532ceeacb75be3e52f7c7e9b2d6737122e71651437135b24a134ab10
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral24
    • Target
      $R0/Bento/window/window-elements.png
    • Size 14KB
    • SHA256 02ef1ce8c48c034d0f7f59453fc879ae8301bf867a7936b5f29868c9c2716faf
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      $R0/Bento/window/window.png
    • Size 1KB
    • SHA256 70a0602c05392b5c3b5543cf8ad4bc858206ba214ee0d86a655258efca4de275
    • MD5 SHA1 SHA512 TLSH
    Score
    1/10
    behavioral26
    • Target
      $R0/Bento/xml/config.xml
    • Size 26KB
    • SHA256 2d9cf8915a0b3ae9d0fdaaebdc2cd6361cf134de9a3ffda5166009884b06a3e6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral27
    • Target
      $R0/Bento/xml/notifier-elements.xml
    • Size 1KB
    • SHA256 52ab28d3b1497e062163ff1d789cd502afd7aae1b0ec4c4b17d651c05e34cb26
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral28
    • Target
      $R0/Bento/xml/notifier-normal.xml
    • Size 3KB
    • SHA256 5d93f5c9563ecba294e9a69d975b047863a9589bee20b73fd49e2e55daba04c9
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral29
    • Target
      $R0/Bento/xml/notifier.xml
    • Size 345B
    • SHA256 a93e8fedacf1f690752d941cd26e8477d93c2f5d017e62cbb487607967b3f544
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral30
    • Target
      $R0/Bento/xml/player-elements.xml
    • Size 58KB
    • SHA256 9a37d2ceba576f3ca89e719c723d44934c1f360136a13c9cbad18e5d224eeae1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral31
    • Target
      $R0/Bento/xml/player-normal-group.xml
    • Size 17KB
    • SHA256 9302da8431bf683425be419265df263fca203619034469982d23f332302cdff8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

Windows Command Shell

1
T1059.003

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

2
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

Remote System Discovery

1
T1018

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

revoked_codesign
Score
8/10

behavioral1

defense_evasiondiscoverypersistenceprivilege_escalationransomwarespywaretrojan
Score
8/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

execution
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

adwarediscoveryspyware
Score
3/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

adwarediscoveryspyware
Score
3/10

behavioral28

adwarediscoveryspyware
Score
3/10

behavioral29

adwarediscoveryspyware
Score
3/10

behavioral30

adwarediscoveryspyware
Score
3/10

behavioral31

adwarediscoveryspyware
Score
3/10

behavioral32

adwarediscoveryspyware
Score
3/10