Overview

overview

8

Static

static

3

Wub_setup\...er.dll

windows10-2004-x64

8

Wub_setup\...er.dll

windows11-ltsc_2024-x64

8

Wub_setup\...up.exe

windows10-2004-x64

8

Wub_setup\...up.exe

windows11-ltsc_2024-x64

8

Wub_setup\...20.dll

windows10-2004-x64

1

Wub_setup\...20.dll

windows11-ltsc_2024-x64

1

Wub_setup\...20.dll

windows10-2004-x64

1

Wub_setup\...20.dll

windows11-ltsc_2024-x64

1

Wub_setup\...20.dll

windows10-2004-x64

1

Wub_setup\...20.dll

windows11-ltsc_2024-x64

1

Wub_setup\...40.dll

windows10-2004-x64

1

Wub_setup\...40.dll

windows11-ltsc_2024-x64

1

Wub_setup\...40.dll

windows10-2004-x64

1

Wub_setup\...40.dll

windows11-ltsc_2024-x64

1

Wub_setup\...0u.dll

windows10-2004-x64

1

Wub_setup\...0u.dll

windows11-ltsc_2024-x64

1

Wub_setup\...40.dll

windows10-2004-x64

1

Wub_setup\...40.dll

windows11-ltsc_2024-x64

1

Wub_setup\...40.dll

windows10-2004-x64

1

Wub_setup\...40.dll

windows11-ltsc_2024-x64

1

Wub_setup\...40.exe

windows10-2004-x64

3

Wub_setup\...40.exe

windows11-ltsc_2024-x64

3

Wub_setup\...40.dll

windows10-2004-x64

1

Wub_setup\...40.dll

windows11-ltsc_2024-x64

1

Wub_setup\...in.dll

windows10-2004-x64

1

Wub_setup\...rt.dll

windows10-2004-x64

1

Wub_setup\...se.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    50eecb042312ad05fad8149e9a2409d44432c21a9331f5c95f463a017b24cf8e
  • Size 15.3MB
  • Sample260930-kxzhssvapd
  • SHA256 50eecb042312ad05fad8149e9a2409d44432c21a9331f5c95f463a017b24cf8e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutionpersistenceprivilege_escalationrevoked_codesign

Malware Config

Targets

    • Target
      Wub_setup\SqlSetupBootstrapper.dll
    • Size 19KB
    • SHA256 51a48213f2149a80c0aa530a7087803e84c37d2733bb937ef8e6d6b125f9fb32
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutionpersistenceprivilege_escalationrevoked_codesign

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      Wub_setup\Wub_setup.exe
    • Size 74KB
    • SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutionpersistenceprivilege_escalationrevoked_codesign

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral3behavioral4
    • Target
      Wub_setup\redist\2013\msvcp120.dll
    • Size 644KB
    • SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      Wub_setup\redist\2013\msvcr120.dll
    • Size 940KB
    • SHA256 753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      Wub_setup\redist\2013\vcomp120.dll
    • Size 134KB
    • SHA256 7fd73132d9579eebb2e6ee202babc6a49b3744de84c9b34fede0b3be95ec98bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      Wub_setup\redist\2022\concrt140.dll
    • Size 314KB
    • SHA256 b2faf3b85b23c840b654e57d5497a0ad31acd02fb01856cad4725a1715d5f78e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      Wub_setup\redist\2022\mfcm140.dll
    • Size 6.4MB
    • SHA256 3c300e7f3572e5abf2bed7b95ca7acd2fad26803dd88708d42361a4012f25d53
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      Wub_setup\redist\2022\mfcm140u.dll
    • Size 6.4MB
    • SHA256 b4e0c6bbbf88d6febdd583f158f5236c8817d187818e42e24a82a2a946c7dd23
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      Wub_setup\redist\2022\msvcp140.dll
    • Size 540KB
    • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      Wub_setup\redist\2022\vccorlib140.dll
    • Size 342KB
    • SHA256 6b8d8a76c3e6664293407553650e60b94df9aaafc7c92057ea83032bd228e44f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      Wub_setup\redist\2022\vcomp140.dll
    • Size 939KB
    • SHA256 187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral21behavioral22
    • Target
      Wub_setup\redist\2022\vcruntime140.dll
    • Size 120KB
    • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      Wub_setup\redist\msvcp_win.dll
    • Size 626KB
    • SHA256 940a41d9d78c2d2d0ece8d8e4735630735f57ffb95466e350dae3535b40a698a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      Wub_setup\redist\msvcrt.dll
    • Size 683KB
    • SHA256 744606e3d245647943ab7be0d4132ead491c719b908c207afb775e1ed30299f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      Wub_setup\redist\ucrtbase.dll
    • Size 1.3MB
    • SHA256 5e7709a6b71bb818260b6f05c5bb3b6ca0c3ca9bc2f58c6242c1cd9d826d0079
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral2

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral3

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral4

discoveryexecutionpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
3/10

behavioral22

Score
3/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10