General
- Target Institute.zip
- Size 62.2MB
- Sample260820-bb5m9azvdx
- SHA256 c7b429549f0f74af22d0d0a73b5cf7020a48ee00e0d9c87ca8b2698f5d2c6ab4
Malware Config
Targets
-
- Target A3DLIBS.dll
- Size 846KB
- SHA256 945ee95d7da31d4184572c33a3eb6cf34cbde403db968fb11719ea32c0d55af1
Score1/10 -
- Target AXEDOMCore.dll
- Size 787KB
- SHA256 a43f61fb2f92c329ca7fd120577daf695fc4915a58ca7034509a5ed678359ca9
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target AccessibleMarshal.dll
- Size 30KB
- SHA256 430c38583db5894d962925687bd234e69a47aa1366e3740281e8f2f0244ab618
Score5/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target CITThreading.dll
- Size 143KB
- SHA256 59a8027d4d24636d176d33b64bc739df2330b12ded72871685c1ad06ee513fcf
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Launcher.exe
- Size 20.0MB
- SHA256 4b840844ce458265427c1d9f11917bd94b84561ae7add3252e56cfb8f567e305
Score6/10-
Drops desktop.ini file(s)
-
- Target Westfield.dll
- Size 49.6MB
- SHA256 5ac0ef54f5d651824d2fff31c9c5e291fbeca0aed0dab79d73eb4ef2c5c0b477
Score1/10 -
- Target dvacrashhandler.dll
- Size 103KB
- SHA256 366df5670db84b9d8c8e659a8a52cca4eceecf3de55dae6213d7010dd0af8cb6
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target format_reader.dll
- Size 152KB
- SHA256 70e0434971d589fd9a771ce248617431f50841ae582928892d4f77ce0a8ac241
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target icuuc64.dll
- Size 2.3MB
- SHA256 65eb04cfa9ed2f5e4296234bdf2c9fd3b90dd335475bb2c336d769c228940559
Score1/10 -
- Target lib3mfc.dll
- Size 516KB
- SHA256 6b9471f6afdf93f71b47807d5a47e160abe92643a24562e43824b5d796305030
Score1/10 -
- Target metadata/AGM.dll
- Size 4.4MB
- SHA256 7de67e8b3bf9618092c9baed8b2912bb8d8e9daf0877511dcd55fff1a1cba4d5
Score1/10 -
- Target metadata/BIBUtils.dll
- Size 184KB
- SHA256 972a65982f71d18478ab932ae4337dcb6133f8c07d5c64c5c6ed9ee551743341
Score1/10 -
- Target metadata/ffmpeg.dll
- Size 2.6MB
- SHA256 2d8ca4610564c38bf2f754c694295de7df1895238d89e066f19bb1d3d3c1bae3
Score1/10 -
- Target version.dll
- Size 822KB
- SHA256 627b7c8f8bbbe79cf44ecb6a920896e236d8908081ffea6f16dbf5a02d133c9a
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1