General
- Target Witch&WizardSetup.exe
- Size 128.8MB
- Sample260930-2xk4vacb79
- SHA256 aa3c8859840c01fd60be248269da5d005b7aa2b8d517010ae588a64de61101dd
Malware Config
Targets
-
- Target Witch&WizardSetup.exe
- Size 128.8MB
- SHA256 aa3c8859840c01fd60be248269da5d005b7aa2b8d517010ae588a64de61101dd
Score8/10-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score3/10 -
- Target LICENSES.chromium.html
- Size 18.6MB
- SHA256 0883a9eb407906c12b334d89bc5fbc63bd1df9e0803c252cc8d23cb76b6d58f3
Score3/10 -
- Target WitchWizardSetup.exe
- Size 213.5MB
- SHA256 c68d9ce0e48397e9e136f667196976d0e6b40c231376e8a45b12b654129e2c02
Score8/10-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Executes a VBScript file via the Windows Script Host.
-
- Target d3dcompiler_47.dll
- Size 4.5MB
- SHA256 c8e25abd3d45dfb55966a74613258c39b4a83ea2ac77f2f80903499f4d5c03f0
Score1/10 -
- Target dxcompiler.dll
- Size 24.5MB
- SHA256 19b5788f5fc04c963b191efab9795bf4a294b0dc7dc8a33e3c4c75e7d13bbda9
Score1/10 -
- Target dxil.dll
- Size 1.4MB
- SHA256 436f128f22050ae27323da61321a469de0678def7a4e6d86f9ccad4858724f0a
Score1/10 -
- Target ffmpeg.dll
- Size 3.0MB
- SHA256 f6f46577037db135c29490155bde31014af67a7770f43dfb4e3d7607873170cb
Score1/10 -
- Target libEGL.dll
- Size 510KB
- SHA256 1d39cd65afeacdd3270fd5c47301d0727ca3467f8e50e17b13bfa861f28fcc25
Score1/10 -
- Target libGLESv2.dll
- Size 7.6MB
- SHA256 9869159dc3f62f52033c38ad22fa7a586555d103b56e30091234690525f19cba
Score1/10 -
- Target resources/7za-ia32.exe
- Size 773KB
- SHA256 31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435
Score3/10 -
- Target resources/7za.exe
- Size 1.2MB
- SHA256 b0cfdeaf429f5cc53f85123dd8f5a5feb92c19d31aa34df257edf9a26be05f95
Score1/10 -
- Target resources/app.asar
- Size 31KB
- SHA256 a2f26651047e96e15c594742fe32d24377000e0aa32d1cdd2b0f8dd5ca964690
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/7x.sh
- Size 235B
- SHA256 ad693686d24184b7bc49fc357b93fca63d35a62d6509b7225252d7f18701f49a
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/index.js
- Size 500B
- SHA256 48659f660a13b5fa01622f87dc8a5306ce7c232abf93b82a3b2f6e94c2cf5c86
Score3/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm/7za
- Size 983KB
- SHA256 3a68d5c794bb8534040f3f93480a7fe8194bf5ed8e0d3e2ac0de4dea9677a64c
Score4/10 -
- Target resources/app.asar.unpacked/node_modules/7zip-bin/linux/arm64/7za
- Size 1.1MB
- SHA256 d363b0055afb4f7f336152dd5d00f1cc992d6e86a56e4a1ec84b2ac26dee27ff
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
2Hidden Window
1Ignore Process Interrupts
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
4System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2System Time Discovery
1