General
- Target Loader-1.0.1-setup.exe
- Size 57.9MB
- Sample260818-ynf7ragm9v
- SHA256 29036b4bea04b2580fb94dc09e80645e8c0edd5489326706f775abb8a55fca5c
Malware Config
Targets
-
- Target Loader-1.0.1-setup.exe
- Size 57.9MB
- SHA256 29036b4bea04b2580fb94dc09e80645e8c0edd5489326706f775abb8a55fca5c
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
Hide Artifacts: Hidden Files and Directories
-
- Target $PLUGINSDIR/SpiderBanner.dll
- Size 9KB
- SHA256 996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/WinShell.dll
- Size 3KB
- SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
Score3/10 -
- Target $PLUGINSDIR/app-64.7z
- Size 57.4MB
- SHA256 0e3bfa5892c253ce74bda28a89bc9b0d39ab3971ac5aa08137caa447b4f91660
Score1/10 -
- Target LICENSE.electron.txt
- Size 1KB
- SHA256 c44607a865e7a6db05552baa0ef71f9887d96acd00d123854b44996bc27c0e33
Score1/10 -
- Target chrome_100_percent.pak
- Size 123KB
- SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
Score3/10 -
- Target chrome_200_percent.pak
- Size 183KB
- SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
Score3/10 -
- Target icudtl.dat
- Size 9.9MB
- SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
Score3/10 -
- Target locales/am.pak
- Size 145KB
- SHA256 4c0b4273dc4103c666ff01ed8b9db995f68c5c178973465bb25cd5cdf99ef01a
Score3/10 -
- Target locales/ar.pak
- Size 148KB
- SHA256 776db47dd91bce8bc813a54a815be3e73b6e58e9fe5f24db7bf0d8c06a240f6a
Score3/10 -
- Target locales/bg.pak
- Size 158KB
- SHA256 6c62771c4673320b40e6c73b3a6a7fdf441e94e1866021b9f253c93d419fab8a
Score3/10 -
- Target locales/bn.pak
- Size 208KB
- SHA256 2fa9fa7d2a69818846ff28e05f0f48817a7cd1c608315ac84e4ef3ca43f70ca4
Score3/10 -
- Target locales/ca.pak
- Size 101KB
- SHA256 93f1feadeb46fc05aa43d8f1b0368e5c57a3eec334187a96a730d7958c6fa9cd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/cs.pak
- Size 103KB
- SHA256 0c554977f587f1910ab077d99b97f5011f5c466f0b6d86df08f9a4c7c940d99f
Score3/10 -
- Target locales/da.pak
- Size 94KB
- SHA256 88da5fab329c56d1625205cf1a27f508a4797d4129c59d2a966b2628ae4545b9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/de.pak
- Size 101KB
- SHA256 8aa79db66cff1cc9f6bd19b3832d7a787bce3ee23e2c83a3725f4ba5db883263
Score3/10 -
- Target locales/el.pak
- Size 176KB
- SHA256 9655c11e3c3c70f30104effa382cf3e9614e63f6c01e12d3e55768a0b1467781
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/en-GB.pak
- Size 84KB
- SHA256 cbe3e2904ae4ec757576c1223605754b3a3f41f29a395aceda8738e92f4d65cf
Score3/10 -
- Target locales/en-US.pak
- Size 85KB
- SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
Score3/10 -
- Target locales/es-419.pak
- Size 99KB
- SHA256 2786809ab8fec0874955f37130fa3b0d0edd2ae1500b052e78dce583a9883ac7
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/es.pak
- Size 101KB
- SHA256 115c1c08de2d8d250cffbdc458f96d716531c122ccefb23c6d3a087828c9792e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/et.pak
- Size 91KB
- SHA256 7eea04d27a3a6b04f6ae51b817705fbdf9a17ed3ee32638bbf4c0d2f25f96f7e
Score3/10 -
- Target locales/fa.pak
- Size 141KB
- SHA256 38fe2704e2f84f400760f424054037dcc99c3d710c942532ca0ef8f3b2843972
Score3/10 -
- Target locales/fi.pak
- Size 93KB
- SHA256 528e453ee8fd16b6e2066b5417b115504cd31afc4ffbd79206369c747caad1fe
Score3/10 -
- Target locales/fil.pak
- Size 103KB
- SHA256 500906ac9cab570726fe2c3c819eec3f88cb69f326857920d8423883c222c773
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target locales/fr.pak
- Size 109KB
- SHA256 0ddb18e05d4a58c010a42207af0ffdfaf12f9bee29f6971459bd69fdf26b0e79
Score3/10 -
- Target locales/gu.pak
- Size 199KB
- SHA256 5a23541ce618f91b78a809fe91a0c68681e20018c4411e00d8c205ab1d850dbf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target $R0/Uninstall Loader.exe
- Size 135KB
- SHA256 b94714e3ce8d4ba5c95c469feee607ccb67c315a0630958c278c069c8184bf84
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
2Event Triggered Execution
1Component Object Model Hijacking
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Hide Artifacts
2Hidden Files and Directories
2Indicator Removal
3Clear Persistence
1File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1