General
- Target Mechvibes.Setup.2.3.6-hotfix (1).exe
- Size 76.7MB
- Sample260802-e6hzhstsbs
- SHA256 00ddeff79c9dfe78eb915c521511f598909e35a989806166b0d8ed1ecbd2a015
Malware Config
Targets
-
- Target Mechvibes.Setup.2.3.6-hotfix (1).exe
- Size 76.7MB
- SHA256 00ddeff79c9dfe78eb915c521511f598909e35a989806166b0d8ed1ecbd2a015
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/INetC.dll
- Size 238KB
- SHA256 ed04a4823f221e9197b8f3c3da1d6859ff5b176185bde2f1c923a442516c810a
Score3/10 -
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/UAC.dll
- Size 14KB
- SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
Score3/10 -
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 4.9MB
- SHA256 a6692be8af33d0673504a5d2bd519f4738aa872595eccc0434f5921185c0d56d
Score3/10 -
- Target Mechvibes.exe
- Size 125.1MB
- SHA256 989f770da70ebb4e392ebd0680f0c0a0ab2dc658f4fe4ea71ef0c65836f56960
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libEGL.dll
- Size 436KB
- SHA256 b516cf5b8073ef35797e8cd422b62ebc117d8bc49471392a9f249d5d20dd8269
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libGLESv2.dll
- Size 7.5MB
- SHA256 47b58af0713e4563489f85716abaed659d8ac85064e3e498cc5af5582da3f537
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target resources/app.asar.unpacked/node_modules/easy-volume/dist/index.js
- Size 1KB
- SHA256 b434b37e2f168c20d7df926366cb79585421d4671fdbf2b927db71b0bb379dcf
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/easy-volume/dist/platforms/darwin/index.js
- Size 2KB
- SHA256 7a79418184bdd19514ef0b3a6dcc73e54a41396e8e84c25097bc0b34f941a350
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/easy-volume/dist/platforms/linux/index.js
- Size 3KB
- SHA256 0e1b7013013fea4407a0799a6ba6403053f2ab3aa377e85b68f2dca0c1c32bb2
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/easy-volume/dist/platforms/windows/index.js
- Size 2KB
- SHA256 c4425f498cc1dbd83b5e500936690c9b953231e9e7eaa47e4b63f32ad1fa1bb3
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/easy-volume/dist/platforms/windows/volume.exe
- Size 145KB
- SHA256 71893b9d33fc1ac90456a32c11185abf6bf2af5b804a74d0897f12d9c2e9609c
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2JavaScript
1Windows Command Shell
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1