Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://release-asse...

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    https://release-assets.githubusercontent.com/github-production-release-asset/1212872222/c00fc1b1-c73f-4f8c-9930-c00ac7c45f87?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-24T15%3A45%3A14Z&rscd=attachment%3B+filename%3DPrismLauncher-Windows-MinGW-w64-Setup-11.0.3.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-24T14%3A45%3A14Z&ske=2026-08-24T15%3A45%3A14Z&sks=b&skv=2018-11-09&sig=0oj401D14k6ZYr8SlZTQBr6ck1ePqfxvW4lTUCmTH8Q%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NzU4NDc2MywibmJmIjoxNzg3NTgyOTYzLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.NeoFQSynmOqkxqLRT-UCK56qyUuL8mAUZ99eCubRImo&response-content-disposition=attachment%3B%20filename%3DPrismLauncher-Windows-MinGW-w64-Setup-11.0.3.exe&response-content-type=application%2Foctet-stream
  • Sample260824-r7a2hszbmc
Score
8/10
defense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

Malware Config

Targets

    • Target
      https://release-assets.githubusercontent.com/github-production-release-asset/1212872222/c00fc1b1-c73f-4f8c-9930-c00ac7c45f87?sp=r&sv=2018-11-09&sr=b&spr=https&se=2026-08-24T15%3A45%3A14Z&rscd=attachment%3B+filename%3DPrismLauncher-Windows-MinGW-w64-Setup-11.0.3.exe&rsct=application%2Foctet-stream&skoid=96c2d410-5711-43a1-aedd-ab1947aa7ab0&sktid=398a6654-997b-47e9-b12b-9515b896b4de&skt=2026-08-24T14%3A45%3A14Z&ske=2026-08-24T15%3A45%3A14Z&sks=b&skv=2018-11-09&sig=0oj401D14k6ZYr8SlZTQBr6ck1ePqfxvW4lTUCmTH8Q%3D&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmVsZWFzZS1hc3NldHMuZ2l0aHVidXNlcmNvbnRlbnQuY29tIiwia2V5Ijoia2V5MSIsImV4cCI6MTc4NzU4NDc2MywibmJmIjoxNzg3NTgyOTYzLCJwYXRoIjoicmVsZWFzZWFzc2V0cHJvZHVjdGlvbi5ibG9iLmNvcmUud2luZG93cy5uZXQifQ.NeoFQSynmOqkxqLRT-UCK56qyUuL8mAUZ99eCubRImo&response-content-disposition=attachment%3B%20filename%3DPrismLauncher-Windows-MinGW-w64-Setup-11.0.3.exe&response-content-type=application%2Foctet-stream
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceransomwarespywarestealer

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • System Binary Proxy Execution: wuauclt

      Abuse Wuauclt to proxy execution of malicious code.

      defense_evasion

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks