General
- Target PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
- Size 22.8MB
- Sample260813-tpblfaca72
- SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
Malware Config
Targets
-
- Target PrismLauncher-Windows-MSVC-Setup-11.0.3.exe
- Size 22.8MB
- SHA256 6c61bd9fef98c21750b021e0450896749cb25e75b91716bf22423d7ca64c1cb4
Score6/10-
Adds Run key to start application
-
Downloads MZ/PE file
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Drops file in System32 directory
-
- Target $PLUGINSDIR/NScurl.dll
- Size 6.0MB
- SHA256 d9438094e22bd3183864b712e2cbae07f6b184a5ad7b018185e425e215feaca9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 7KB
- SHA256 2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77
Score3/10 -
- Target Qt6Core.dll
- Size 9.8MB
- SHA256 e898be1717f33e5be968a5d07c56f6cdf6f236c7888bebf3ada8db55a72dff0f
Score1/10 -
- Target Qt6Gui.dll
- Size 9.1MB
- SHA256 f872c2b0f6a8aa92c80006dc272f2af0137f1172510a07e5687dd23b9e84d048
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Network.dll
- Size 1.7MB
- SHA256 c99cdc8fe49d4ffef4585616181e977674ffddf5c83e04f8a7bfa710ef7a113c
Score1/10 -
- Target Qt6NetworkAuth.dll
- Size 289KB
- SHA256 f72beabb77f4212b2121f29fe6a905860922fc96e065e391e606e7edc57a2970
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6OpenGL.dll
- Size 1.9MB
- SHA256 74bae72a5e3059b47d7213dc0c05319cbf2e27004c96197e35cff6b58f72d83d
Score1/10 -
- Target Qt6Svg.dll
- Size 620KB
- SHA256 f753e3ecab676c13afacc3ce384a67e882f61245451358da643c190ad4b0d028
Score1/10 -
- Target Qt6Widgets.dll
- Size 6.3MB
- SHA256 96e9e1514101f4a4fad67a7e34aa2b8c2ec135f4eeb7f56ec26f3e00bd97c1fb
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Qt6Xml.dll
- Size 159KB
- SHA256 543669c722f33a40dbafab441e1590a0d8aaa48b17db66a64a7db32e4cccd721
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target archive.dll
- Size 731KB
- SHA256 812e646111face02ae8492d39582bce216845568513b72ada52cb2c4ca0b3f40
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bz2.dll
- Size 90KB
- SHA256 39a7d40a7dcf21fc6b09352907465e941a1a6799aa28f6c0d7875785d33e12e2
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target cmark.dll
- Size 155KB
- SHA256 85618e723dc422d863765a427c8fb905d2b26aa3f8f7ad6bdf21441dc488c973
Score1/10 -
- Target iconengines/qsvgicon.dll
- Size 73KB
- SHA256 0364cd20e00a02d80722b4e5ea36f3f0e3df8b2a868720083c87765ba4738af0
Score1/10 -
- Target icuuc.dll
- Size 51KB
- SHA256 09b775cae86f5dd0d10335c6dd8028f1bdebab800ad46e4d748407b3534a3651
Score1/10 -
- Target imageformats/qgif.dll
- Size 50KB
- SHA256 35a334aad6e7b4414a1663930a62d951fead4026eea47a822731fd70bfdf165c
Score1/10 -
- Target imageformats/qicns.dll
- Size 58KB
- SHA256 af6dbfee7b4620fa0fd19d05ea4b0ce06f264d3881a5c2604de690fa4f7d7f90
Score1/10 -
- Target imageformats/qico.dll
- Size 48KB
- SHA256 7090af10ba907e7c6540ded1eb1b5d0f01dd560cc4018ab451915f9323ec32f3
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target imageformats/qjpeg.dll
- Size 567KB
- SHA256 7e9674ea5355e96d4db5c22bbc367d5fd84e590c00ae9209310c07f7532004ce
Score1/10 -
- Target imageformats/qsvg.dll
- Size 41KB
- SHA256 3b867a449efb27a2df9f14286d74c895392f13865e7af55e39550d48547dc4f5
Score1/10 -
- Target imageformats/qtga.dll
- Size 40KB
- SHA256 68d3514f6843b349a07d72ebb01f8f6cd8894efb9f6d3d3f7db2549a002e7ca6
Score1/10 -
- Target imageformats/qtiff.dll
- Size 434KB
- SHA256 e0d37ba43fed59c34e786939afd8d98ef6f77611c1ab03c0ad9b7abeefb288d8
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target imageformats/qwbmp.dll
- Size 39KB
- SHA256 512d390c159f7a37efdc1e43b08db2a493ab9d6e7577c8d7dcb3972526496e2b
Score1/10 -
- Target imageformats/qwebp.dll
- Size 552KB
- SHA256 7c3e0e414d07e234f63459c627d3d0ba95f128b9289621e9576810c011f199b3
Score1/10 -
- Target jars/JavaCheck.jar
- Size 1KB
- SHA256 9a3ce879970517ed86f649360ea530dc14f4006b695c0935f98e10aa4be09803
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target jars/NewLaunch.jar
- Size 13KB
- SHA256 5086c5086c78bc74dad6c7fe0e20fe904cfce6d9a67c63fce80f7907ca731eb6
Score1/10 -
- Target jars/NewLaunchLegacy.jar
- Size 23KB
- SHA256 e9429eadcfce33c20a9509ea18c155430c5d8f9c8e9007b125df2a05fbde7a9b
Score1/10 -
- Target liblzma.dll
- Size 199KB
- SHA256 1f423fcdc9108b8878156ed27109fbdb17b7b90b758935ef308516f42157fbb2
Score1/10 -
- Target lz4.dll
- Size 138KB
- SHA256 91fbd4bd121e1cef7191997ae9cb0027746b3b19641d630f332c1b8df9f5d382
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1