General
- Target Tools_Unlock_Pro.rar
- Size 136.9MB
- Sample260816-q9extazvfv
- SHA256 c5c37a053ad40495ab4d62a739019dea188af0079cd253331cbe42a8d15f8645
Malware Config
Targets
-
- Target MEIPreload/CPFilters.dll
- Size 862KB
- SHA256 f558343f4693c151f9416b20cded176e1da4e6ebc133eb526d1dd5f5fdf596f0
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target MEIPreload/CredProvDataModel.dll
- Size 573KB
- SHA256 5eb2abd74b415c4f0df6a20358045873c437a146427095493790a431606cc8bd
Score1/10 -
- Target MEIPreload/Qt5Core.dll
- Size 5.1MB
- SHA256 4f8dc460162407cfccb1be6ef9cce45c4449de838aeffa3fd33378f01a3f9cc4
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MEIPreload/Qt5Gui.dll
- Size 5.6MB
- SHA256 80016776efea2b2a838c3ffa4c82e5f146baff68c36073c0c34668809d1c4297
Score3/10 -
- Target MEIPreload/Qt5Network.dll
- Size 1.0MB
- SHA256 37275f3ea79d15a2792bf21f71f1df825f201cf8b33aa1f94ca93d62d76b216c
Score3/10 -
- Target MEIPreload/Qt5Qml.dll
- Size 2.8MB
- SHA256 e45f26ebbc2b0499e0e90f1666fd13f1bb2bed1073e828d30b6a3a70599d4bc9
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MEIPreload/Qt5Quick.dll
- Size 3.3MB
- SHA256 5f246016691ff883243ee9b3c9215eb16b859b12aefc5f4bbd2fbda3911883de
Score3/10 -
- Target MEIPreload/Qt5WebEngineCore.dll
- Size 71.6MB
- SHA256 4d8875a7dcda59339a0c2b1e5abbfe8de883fbd2688bdfc3a143e7b2da650975
Score3/10 -
- Target MEIPreload/Qt5Widgets.dll
- Size 4.3MB
- SHA256 600285754e7eee7239b9d252dbed5c9d2c9c4c432751b8953dcb2e8b45e0408a
Score3/10 -
- Target MEIPreload/avcodec-57.dll
- Size 14.0MB
- SHA256 0be1ab58ef33c40fa092cc56b1730967e77fb5cc3c54f09a0e599b0e658f389c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target MEIPreload/opengl32sw.dll
- Size 15.3MB
- SHA256 25ae7577e066fa80519a8f1c314b15cdd22e4a8d3ecd2a36eccc79e40714a91d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ToolsUnlock_v12.5.exe
- Size 1.7MB
- SHA256 70ea603ab5a0c9ef1a82f6cf4fcb5baa7a5cd32cb63584094d95fc5a27091baf
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1