General
- Target OGTool-Setup.exe
- Size 57.9MB
- Sample260802-bssp1sbl5x
- SHA256 d1aa3af314532925cab859f24bacf7b037d147f5fd0310f9822a1da19d184487
Malware Config
Targets
-
- Target OGTool-Setup.exe
- Size 57.9MB
- SHA256 d1aa3af314532925cab859f24bacf7b037d147f5fd0310f9822a1da19d184487
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
Hide Artifacts: Hidden Files and Directories
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target LICENSES.chromium.html
- Size 4.9MB
- SHA256 a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d
Score3/10 -
- Target OGTool-Setup.exe
- Size 125.0MB
- SHA256 2792032f8e8f9744c750a98fa37f23752319af59631c723a3ed27e43e95f8a31
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
Hide Artifacts: Hidden Files and Directories
-
- Target d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 ac011aa2e40105d07ec683b24dd0142800aaf0d86102291489f156ef3b514640
Score1/10 -
- Target libEGL.dll
- Size 436KB
- SHA256 585762741775152414c6eb353fb1eba8423e7a1c1ade8c49ac6c7a0beb326f71
Score1/10 -
- Target libGLESv2.dll
- Size 7.5MB
- SHA256 aa3a955e5e49793b7dedeae927fe970c1f5dd2daa44742045a00fd3937cf2a1e
Score1/10 -
- Target node_modules/@primno/dpapi/dist/index.js
- Size 412B
- SHA256 a7ff0225cb5ebcbef8499c6c8ac2be924f584eb375dacb1d8bd3dc6540b510f2
Score3/10 -
- Target node_modules/@primno/dpapi/prebuilds/win32-x64/node.napi.node
- Size 137KB
- SHA256 da2172ce055fa47d6a0ea1c90654f530abed33f69a74d52fab06c4c7653b48fd
Score1/10 -
- Target node_modules/adm-zip/adm-zip.js
- Size 37KB
- SHA256 dc6a2239b69829b7d20aeefc9f5540aa69564d0cac476e442afeb030ae64ca07
Score3/10 -
- Target node_modules/adm-zip/headers/entryHeader.js
- Size 11KB
- SHA256 b6fc4b17ceab96c07d6c14464b95204b1a130d32d845b348a18eefd5633763b1
Score3/10 -
- Target node_modules/adm-zip/headers/index.js
- Size 94B
- SHA256 536e4b5bf009a3d9f6eccfbbc4157cb6de663d889e0826ea5f6e5fa17aaeb8bf
Score3/10 -
- Target node_modules/adm-zip/headers/mainHeader.js
- Size 4KB
- SHA256 28dd1a0db451bc94d8f3234e57d8192ba17154118f841c398e0de35acea286ee
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
2Hidden Files and Directories
2Indicator Removal
3Clear Persistence
1File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
2System Time Discovery
1