Overview

overview

7

Static

static

3

1.bat

windows10-2004-x64

3

1.bat

windows10-ltsc_2021-x64

3

1.bat

windows11-21h2-x64

3

1.bat

windows11-ltsc_2024-x64

3

SyncHost.exe

windows10-2004-x64

1

SyncHost.exe

windows10-ltsc_2021-x64

1

SyncHost.exe

windows11-21h2-x64

6

SyncHost.exe

windows11-ltsc_2024-x64

1

propsys.dll

windows10-2004-x64

7

propsys.dll

windows10-ltsc_2021-x64

7

propsys.dll

windows11-21h2-x64

7

propsys.dll

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    update.zip
  • Size 476KB
  • Sample260916-vg9zpsdn6v
  • SHA256 539e8c9641fbb2004fbf5af4b352c9853293612cb04f8ec639699fcb4abce4c5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalation

Malware Config

Targets

    • Target
      1.bat
    • Size 1KB
    • SHA256 5b3bc029d68b1d0d36940dbae7a62598706c4042cbf22a902e80cc40a86f5682
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral1behavioral2behavioral3behavioral4
    • Target
      SyncHost.exe
    • Size 42KB
    • SHA256 581f472d7b4222aa55ca742b717905a2607c64ff49a5180c8508e02cf806eee5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral5behavioral6behavioral7behavioral8
    • Target
      propsys.dll
    • Size 1.6MB
    • SHA256 f4ef1dff3515c3428d59e102e454427d38985453556dce236e26d4496834caa1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral10behavioral11behavioral12behavioral9

MITRE ATT&CK Enterprise v16

Tasks