24b2c6ce45d27bfdb14cd4e352180bf7bd866ce9f9565b79b475eba07a72c752

Sharing

Copy URL Twitter E-mail

General

Target
MathType-win-en-7.8.0.0_softoroom.exe
Size 43.4MB
Sample260930-tagtxayfpd
SHA256 24b2c6ce45d27bfdb14cd4e352180bf7bd866ce9f9565b79b475eba07a72c752
MD5 0984ae82d2f00151fd3e891b601619ea
SHA1 475291c51140d2107b341e9671b5f2807c06bfe6
SHA512 7a0f50caf5d98ee5e4820738141a8c82bf5b70d231c440085947bd2443c159e95ca7e7b7272b320f0d2d217c33762b9122e63064c825dea379844597c52d876a
SSDEEP 786432:ometqlZRTGuNDuDVia6JnBep7serZMBqYb/ByCS1ZwqAZafqNKntXamJTsASlLr3:oMlnGXVUA7sB/sCW+B8faKtXamxsAOLD
TLSH
T13AA73377E951942CEDF0ACB05A167BD35E9423EADE4BAA31FB41D2434F647CA4B9000E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  MathType-win-en-7.8.0.0_softoroom.exe
- Size 43.4MB
- SHA256 24b2c6ce45d27bfdb14cd4e352180bf7bd866ce9f9565b79b475eba07a72c752
- MD5 0984ae82d2f00151fd3e891b601619ea
- SHA1 475291c51140d2107b341e9671b5f2807c06bfe6
- SHA512 7a0f50caf5d98ee5e4820738141a8c82bf5b70d231c440085947bd2443c159e95ca7e7b7272b320f0d2d217c33762b9122e63064c825dea379844597c52d876a
- SSDEEP 786432:ometqlZRTGuNDuDVia6JnBep7serZMBqYb/ByCS1ZwqAZafqNKntXamJTsASlLr3:oMlnGXVUA7sB/sCW+B8faKtXamxsAOLD
- TLSH
  T13AA73377E951942CEDF0ACB05A167BD35E9423EADE4BAA31FB41D2434F647CA4B9000E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion discovery persistence privilege_escalation spyware trojan
- Manipulates Digital Signatures
  Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/BlankEqn.doc
- Size 16KB
- SHA256 147d782f708af859cc0bc2362ed7ff3e16094a108683910421abfb5e7630803d
- MD5 3648b219061dc97438d926388a7b8be5
- SHA1 993a4111eb48809de3797b53f87f0a87730c3545
- SHA512 c575151ed8ee96c6baf14ebf9ad5b69a87f030e4c62557b05056df68430c77c52bb00822a10bc86f7a0dfff528b25d97238a7ada3dd5388044dc5e6d6dcfc7bb
- SSDEEP 96:YoGGBcr2LtchnvptNTdkYBwxb/822oHo1Ni1hNwDQy3q3V43d:jGGBcr2Ltchnh3Rkuw9/P1HpwEy3U
- TLSH
  T1E672DB51FFE4CD22D9524A310EB296C1A735BF9C9E12930F316DB71F6C732924AD2612
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/JAWTAccessBridge-32.dll
- Size 8KB
- SHA256 0739ee0fb1d18a0e5dbe5a708041289fd6d538737c0a739c15c0678b355722b7
- MD5 f5140fe1dea102f66a516aff80c944e2
- SHA1 b109c8cfd0fd1e4c2a1c83fd01807fc0d07a098e
- SHA512 b5504e3de5944da822e93bc61d4d3f35216e7da6bf91fcb1e415e1c14b47305e6ade456ab09d64da3e31c254309693c5deeb4e602a2fc27630b639fde0942296
- SSDEEP 96:3TcdaDFZjyvB0qYqlxMQ7EMQ3XLPVAM6iPbwcg8BgMPkKbcuFcS:jcdMm5YEe3XLPVT6msh4g+Euu
- TLSH
  T12002EA3ABBE84027F9FE0B751D72915327247D615F7182BB9B92539F09B0880DC38761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/JavaAccessBridge-32.dll
- Size 119KB
- SHA256 853556ec6d341812340fa1ce922f7030475b95b2b35fef748c134c4ac9eee64c
- MD5 a39f9d159dea989f46d379db7e9110b7
- SHA1 edeb678b7e76f749cc5f88c9932a8ac27fbac34c
- SHA512 3ddae97ac48149d353fbe17c18e941639ed6d31c772923c3fcb11b92c22ede8925755cc2986f4dde6fba40321919bf745f95d361b8701bf37410c33e92a8a2f6
- SSDEEP 3072:hvAznTOzUca38u4XAK/e2Hrgc6kZAn1yEkBKMKy1Zf22QYHJiuzTl8ShzzM+64mR:hvcwUca35zZnQf
- TLSH
  T1BDC3E772FA96B3B6E72D7236AC0016B4BE94952C50378EA3CD5B211F12C7051CDBD9A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/MathPage.js
- Size 14KB
- SHA256 97b44c11870050072c806032af25c052deb61bae47b21aa0ff1b7a727f02079a
- MD5 34786b612a3934b0cb01afa73f0201d1
- SHA1 ce51755d4b2eae60c85e84982b3a3cb8f3c8ac04
- SHA512 bcce92cfc287006c35806adbfb24be0f759d9064ef0b017b299eb0f48e9531974ad8511833be4b0b0058caf3553d0f3baf1b4c47a5a3fa37bffa445d5887ffad
- SSDEEP 384:WngFn19dp02XF+TsAn1VrXYFBsZL4w+a/+/:/Fn19RNAnYMB+a/8
- TLSH
  T10962E8251344363FC5DE72B3758F86E930739405EB82E808C5AFE9AC15A9D86B327E4D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/MathTypeLib.exe
- Size 24.3MB
- SHA256 2c225b75f49cb2ca166e9eff342a0f99f2d126d5b68b90ccccac102f443be6f1
- MD5 ba0cc4ecf8c0928fd83d3e4b7de71d59
- SHA1 efc56ece9f7730158c8ca43761d2e7ca2f07ab96
- SHA512 a92eb84f7d43f69278c383ee8563a8ee088dc9be155e9b963613957216f5ec4a508a2aaa45bbac2dc456156fdeaa049cb46fe5955f191b90d010abb743325de8
- SSDEEP 196608:EThKaEHExEXj+/LTblOWmsEXkodIzdtJV1HYz8NvqWKL/Pwv6lml2GL+:Yhp/ckodsrOgNi5LMwmAGL+
- TLSH
  T176476C03F3C3E172C8479733086B77396332D617A1679787A7A0DA68ADE32825F159D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/PMathML.xsl
- Size 20KB
- SHA256 aaa737652d8ce641c8fb8863c9cd82fd271e6c089e413daea3b4e6106edc0384
- MD5 48f35f91a1ff81fcaed4088bc79fc228
- SHA1 925b9c354157fe331dd362bc7c27b0f9f5a19d43
- SHA512 5bb11bc2f63b288d4c7cb5920bb21aaf4d23d33d3dd4940277988d20bd0081e1545c1829cb74572ca6c51b8645ef29664fdeb7c8fbb53f6d5980644658d065c0
- SSDEEP 192:Xb6OLFiQbB0k+fOIIcGMqeKaLqEhEOKKbyp9/RqoRD7TY+wDlWYwmfYPuP92:3LsQt0hf8cLqEhEOKcyp9/7R8DBAif2
- TLSH
  T1CAA2F798E189DF318735337DE49E6184F62141AB6731AB61F0CC62F7237D94402BBA6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/US_export_policy.jar
- Size 2KB
- SHA256 90012f900cf749a0e52a0775966ef575d390ad46388c49d512838983a554a870
- MD5 ee4ed9c75a1aaa04dfd192382c57900c
- SHA1 7d69ea3b385bc067738520f1b5c549e1084be285
- SHA512 eae6a23d2fd7002a55465844e662d7a5e3ed5a6a8baf7317897e59a92a4b806dd26f2a19b7c05984745050b4fe3ffa30646a19c0f08451440e415f958204137c
- TLSH
  T10751F96ABDD9C17DF25B46B90A48938370F6854C1748FA470890C9A52EBCF110E57EEB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/WindowsAccessBridge-32.dll
- Size 89KB
- SHA256 3d191f0677857feebe29b45fe050ee35e2691826115c3c6c8818738d771a3fd3
- MD5 527eddca52dcab9a1ec3db15fb7e58f2
- SHA1 e1f1cd8879a45f47dc45ddf76add610ac39f0e89
- SHA512 84dc8058e9d567fa5dc92306c742ef2f3a8b396b68abbfb44694f99c21ebcf9026c92c55d6870bc31eaf27e3ee7b9809ffa55228cd1a5ad235920d8f18c89e49
- SSDEEP 1536:T9bA+jstjdp5O96XVs4vnLRJeJTm2e7VXDK4SUVkePx2uT8JlgBJ:uN+6XVsknLoK2UdK3a5auBJ
- TLSH
  T148935C23B290D076C2F701795C1C876DA7BC273C99B19743EBD6235B8F62181927BB62
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/access-bridge-32.jar
- Size 183KB
- SHA256 1c67fa552e5707f4ee13726b1efd989ffc72055be756cd4e52b2ae444ee8674e
- MD5 af2e6a48d8cc15d47c704f90c6db94d8
- SHA1 9c7d65682055aaf623b7c98ba4049ca41000943b
- SHA512 3562245581305b5c8588ab5adb3548f94cd5ca48808b31d9279ce6689c6612dcf64dca60b4b08d0ab8a6516c979553378c72bf0b61d3f5a36e715afa84f94b44
- SSDEEP 3072:5vq40a3cqJsSQXkdZqovfsVLmV47BHQW8MYqpY/eFsDep5V2f1cPWZXVU3:ic47knvf8LmW7VZiqpYWFiR1CWZFy
- TLSH
  T1D5043B43BA4DC46BFA0782F35092EE5279086DFCD2A653AF4CD91B492652C470731BBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/awt.dll
- Size 1.1MB
- SHA256 072eb150d2f4461a14b5ef9a5f9533e16586fcf1e0a71ae558bf4abea3e91534
- MD5 ed16fb5dd63a2231792feb55e5e2a859
- SHA1 802cdc8a86485dcc0c360332754c5aaefc05bb2d
- SHA512 ee368b09612091d82947ef884aacaadc38cc896cc791716d3db6d5e1b433362434b5a346b0b6339e0b66bf3934984429c691a1aa68366c8d4d5614f4ea31d304
- SSDEEP 24576:qohLz79QpanpUtQuFlOYwBqxdiBSYy6WxDeRx/HByz:dutFYbWxDeRx/HQz
- TLSH
  T1A1458D42B6C6C0B3F85E2675992BF73E2676AB051321C6E77AE43F5F98303E25434246
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/charsets.jar
- Size 2.9MB
- SHA256 41400f669f68e01051de39d8e339cd126593a8bd3207ddf39d184f177958bf1b
- MD5 1a6cbb8deac037d59b48ad1e2a15d5c8
- SHA1 b962e9947038158770ce3f49ba83e24f6f570159
- SHA512 6d4bbd20ca99aea49ae870c615f239f9d2cbbce467992fd8d239b0d8c72b691aa7a362e24b17e3dbb0efda6f16ee68347ed54ed0fbffe3f9672b86cd1dd503aa
- SSDEEP 49152:x0fi+Wz1nc4Zq0Z/UI3I5rLAEwnvvK8lbIOVO:efidzN/d/0qn3vlbIH
- TLSH
  T1AAE59FD344451EAFD60B52BF1B60EE0B770E7CA61907B240F9BA4C19EA5C62F64D2F21
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/copybtn.exe
- Size 54KB
- SHA256 2d00c4d663072191cf4817f2ffb5388fdf01095cd2685797bacdea48c3fac055
- MD5 fdddeafd333083c2e839bd1af02843e4
- SHA1 80f5b641372c8de38b9db54b5a31f773bae4d551
- SHA512 3ba6d417d3d0bb63d05b790cbb72c21a4bb50cd193f7a27cb6bd37e5127a17eaea16ee16b3f10c9efadc1fa8248ab69b6182f9cb570f469a88635480cb001fcd
- SSDEEP 384:aWEh0851UQlBMWDCd3RU6DDaLq93fqeyiES9EglonReRxsYkz38s8cn/fuSPLmFn:uh08LUQ7MWm86VCeLruglonRe/ehd/+Z
- TLSH
  T1A5433932EDA75312D8C275B08AB48EC6373B7A113AF0442B96D45B4B2F665F2DD15338
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/dcpr.dll
- Size 133KB
- SHA256 3ae169f969e221d3b3a7cf3efe8745da1ae19f4ed42e3e14d9122fd9e4dd0baf
- MD5 8b8026bf4f55ef86489a14c9368467cc
- SHA1 43f8a31afbad57d9894cb70757ebcb26e262ff52
- SHA512 5919d0003147713514db7f75239a3cc0aa9c2d18286659ca2204746fae337f92f6494834a2bf169193743b02a77c32168734404bd181a1c0a859374f8931453b
- SSDEEP 3072:T2ua3LV+GxPo9o9No495My8cj5ojGylYCE2Iu2jGLF5A9bE8LUern:pa3RXxPQzybIGgYCE2L1F5A9bEGUe
- TLSH
  T159D3C0037970C135D422C37AA02B1B54BA583B0449FEF116FF9C93969E389D0D5BAED5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/fontmanager.dll
- Size 212KB
- SHA256 4b6ac72c4f1db85a0341caee879397e86c16272e2fdb047196b6555e3d3f1314
- MD5 c5942b3041c57c4a083582fa60e027a7
- SHA1 e260bb4b61d1624b6029d766ba966b759da905de
- SHA512 ea76631c25d2891f99c6d60e3d4067ccd5f8657748038770b3a8c16f10aa67f22de183b389e0533406e70bd81abfb590dc16a25c814c559e9490f4e02d411c59
- SSDEEP 6144:xdYViUbbNkLpg0ZiBfDTu9aJQad1UchFGMReiDrUj7OB+:xdYViUbbNkLpg0ZiBfDTu9aSaLGS
- TLSH
  T147246A92BA8312B1FEED6175103B6B2E472A9F59C712D2C393203FD90C3E6E459F4295
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral29 behavioral30
- Target
  $LOCALAPPDATA/Temp/mathtype.tmp/j2pcsc.dll
- Size 10KB
- SHA256 84598ba5d55715f7ae169f168d1f1c6d4f82385822cd6b17706b19add0118795
- MD5 082fcf36dbcdc2ae39b7a05fa50c8221
- SHA1 214044ccbb0c4eacf6f68a9361aa21d7530faaa4
- SHA512 0ba186c7a4e0bf4d8aecb30bbdda5e460acea8c5aad7b9035ad7d5b62858702a9b4b04cd144121ae05efb67cadd39b6f1cfc6a02464e9c887747d638d1b1995d
- SSDEEP 192:pN+oJRa3faYQu4H7nhTZw3SSunY3X3PVR6y8jzqpYOyb:pN+oJkChdw3SvnonPV58y+Oyb
- TLSH
  T109221A063B98C033F6BE2B794D361322E67DBA00BF6154574B129B2917A95E18D32B86
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Manipulates Digital Signatures

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Checks installed software on the system

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32