General
- Target 150c9700782f0939d8208b8b43a89e4d618059f7e6f8f67af0f73f1c212eaea1
- Size 1.2MB
- Sample260821-vl2twstgph
- SHA256 150c9700782f0939d8208b8b43a89e4d618059f7e6f8f67af0f73f1c212eaea1
Malware Config
Targets
-
- Target ZyperWin++4.1/AntdUI.dll
- Size 2.6MB
- SHA256 80db11b7bc1210085269860bbed0c7d86bec176cea296b17c9693df91a8ad839
Score1/10 -
- Target ZyperWin++4.1/Bin/Defender/EnableWD.bat
- Size 2KB
- SHA256 d97273b4160c366d458c1e2750e205ca195b976756b337b4b3350e4fcf1ca428
Score10/10-
Modifies security service
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Adds Run key to start application
-
Modifies Security services
Modifies the startup behavior of a security service.
-
- Target ZyperWin++4.1/Bin/Defender/NoticeON.bat
- Size 170B
- SHA256 5309ab176512653eecd202f15ef9656b64a9569eb93bd22f2b12cbac62b54e68
Score3/10 -
- Target ZyperWin++4.1/Bin/Defender/NoticeOff.bat
- Size 170B
- SHA256 46aba4a53269fa719073d70551da057e6f06b43ed79488ab65f79915b1573220
Score3/10 -
- Target ZyperWin++4.1/Bin/Edge/All.bat
- Size 9KB
- SHA256 7570c1b1e5dcb680269e3b22cc495a4a23d633ad6d15142f627b915959907d87
Score8/10-
Possible privilege escalation attempt
-
Modifies file permissions
-
Stops running service(s)
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target ZyperWin++4.1/Bin/Edge/Edge.bat
- Size 4KB
- SHA256 f3b6bd6035f9f211811f97bc48194177923c6f2c4aa25ff689365bb5a4765b85
Score8/10-
Possible privilege escalation attempt
-
Modifies file permissions
-
Stops running service(s)
-
- Target ZyperWin++4.1/Bin/Edge/EdgeCore.bat
- Size 2KB
- SHA256 c7c4fe9281fa55ff9517bd12142b9d86d7edc98c472f24d6fb88f25dead9f305
Score8/10-
Possible privilege escalation attempt
-
Modifies file permissions
-
- Target ZyperWin++4.1/Bin/Edge/EdgeWebView2.bat
- Size 2KB
- SHA256 cca9999ad7d7b7b8018d3be047efcbc1c125e7df4e5479f7362082bf17b6b9b4
Score8/10-
Possible privilege escalation attempt
-
Modifies file permissions
-
Network Share Discovery
Attempt to gather information on host network.
-
- Target ZyperWin++4.1/Bin/Edge/UpdateStart.bat
- Size 162B
- SHA256 6cc42faab8a8c8c589fc87a337118a00156d85700f798d598fc26a18b37da087
Score4/10 -
- Target ZyperWin++4.1/Bin/Edge/UpdateStop.bat
- Size 277B
- SHA256 2517d22297175687af16118b152f7b3bbbc7f1cfa3518b1c6d5b2eba4e1f0975
Score7/10-
Disables service(s)
-
- Target ZyperWin++4.1/Bin/Explorer11/Win11DisableOrRestoreRoundedCorners.exe
- Size 150KB
- SHA256 30fe82f8975b5322a7474023c18ad7de01bc4ec2cefc444ae65d8bb3f1948d7a
Score1/10 -
- Target ZyperWin++4.1/Bin/Explorer11/右键/Win11恢复原版右键菜单.bat
- Size 165B
- SHA256 85ff6e3d4821d66c92c65fa56445b60f373249f9b5c1de0cbad3a0ef974b4fc6
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ZyperWin++4.1/Bin/Explorer11/右键/Win11恢复经典右键菜单.bat
- Size 162B
- SHA256 6f522b849c21257d23e12978cc348869c55b227d499bba46e9437ec626f24044
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ZyperWin++4.1/Bin/Explorer11/资源管理器/Win11恢复原版资源管理器.bat
- Size 82B
- SHA256 98e4e63e6ea79ffb773e1b69b29f3b179801476a42fb00cdfff064a66e22aff5
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ZyperWin++4.1/Bin/Explorer11/资源管理器/Win11恢复经典资源管理器.bat
- Size 82B
- SHA256 e3d2295808ab31b51ffb768ad350f14ea8727d727073dc6670cd8bca375b94d3
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ZyperWin++4.1/Bin/NSudoLG.exe
- Size 139KB
- SHA256 bdd9286eaefc70e313748693a0372eaa18de535ffebfae0ef658f88f53073e6f
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
2Modify Registry
5