Overview

overview

8

Static

static

3

HiBitUnins...10.exe

windows10-2004-x64

8

HiBitUnins...10.exe

windows11-ltsc_2024-x64

8

HiBitUnins...er.dll

windows10-2004-x64

8

HiBitUnins...er.dll

windows11-ltsc_2024-x64

8

HiBitUnins...20.dll

windows10-2004-x64

1

HiBitUnins...20.dll

windows11-ltsc_2024-x64

1

HiBitUnins...20.dll

windows10-2004-x64

1

HiBitUnins...20.dll

windows11-ltsc_2024-x64

1

HiBitUnins...20.dll

windows10-2004-x64

1

HiBitUnins...20.dll

windows11-ltsc_2024-x64

1

HiBitUnins...40.dll

windows10-2004-x64

1

HiBitUnins...40.dll

windows11-ltsc_2024-x64

1

HiBitUnins...40.dll

windows10-2004-x64

1

HiBitUnins...40.dll

windows11-ltsc_2024-x64

1

HiBitUnins...0u.dll

windows10-2004-x64

1

HiBitUnins...0u.dll

windows11-ltsc_2024-x64

1

HiBitUnins...40.dll

windows10-2004-x64

1

HiBitUnins...40.dll

windows11-ltsc_2024-x64

1

HiBitUnins...40.dll

windows10-2004-x64

1

HiBitUnins...40.dll

windows11-ltsc_2024-x64

1

HiBitUnins...40.exe

windows10-2004-x64

7

HiBitUnins...40.exe

windows11-ltsc_2024-x64

7

HiBitUnins...40.dll

windows10-2004-x64

1

HiBitUnins...40.dll

windows11-ltsc_2024-x64

1

HiBitUnins...in.dll

windows10-2004-x64

1

HiBitUnins...rt.dll

windows10-2004-x64

1

HiBitUnins...se.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    e042b21508e098dca385316a9f1b2557cc811a669c38360b5809350ca6e0c24d.bin
  • Size 19.1MB
  • Sample261006-25nvpsgh63
  • SHA256 e042b21508e098dca385316a9f1b2557cc811a669c38360b5809350ca6e0c24d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign

Malware Config

Targets

    • Target
      HiBitUninstaller-setup-4.0.10\HiBitUninstaller-setup-4.0.10.exe
    • Size 74KB
    • SHA256 f0b332ed4ff4f4dde04cf7463b6aba23d8cd3198bd763a627c5c196c2d775760
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral1behavioral2
    • Target
      HiBitUninstaller-setup-4.0.10\SqlSetupBootstrapper.dll
    • Size 19KB
    • SHA256 dbc432873273991c7f04d42b46931f4a9c4a985db3d3c0c32de0f9377613acbd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Sets service image path in registry

      This determines the executable launched when a service starts. It can be used to establish persistence.

      persistence

    • Signed with revoked ConnectWise certificate

      Binary is signed using a ConnectWise certificate revoked for key compromise.

      revoked_codesign

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Network Service Discovery

      Attempt to gather information on host's network.

      discovery

    • Boot or Logon Autostart Execution: Authentication Package

      Suspicious Windows Authentication Registry Modification.

      persistenceprivilege_escalation

    • Drops file in System32 directory

    behavioral3behavioral4
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2013\msvcp120.dll
    • Size 644KB
    • SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2013\msvcr120.dll
    • Size 940KB
    • SHA256 753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2013\vcomp120.dll
    • Size 134KB
    • SHA256 7fd73132d9579eebb2e6ee202babc6a49b3744de84c9b34fede0b3be95ec98bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\concrt140.dll
    • Size 314KB
    • SHA256 b2faf3b85b23c840b654e57d5497a0ad31acd02fb01856cad4725a1715d5f78e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral11behavioral12
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\mfcm140.dll
    • Size 6.4MB
    • SHA256 40b60a03d8ba74df67cf350a4a8e89f7687634e7f77b4a65e7e224aef7f4c7ea
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\mfcm140u.dll
    • Size 6.4MB
    • SHA256 5d4b6b82c0d091477c5db45faa54e39fb2075e8c4e59d1f30f4f29094b9484e4
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral15behavioral16
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\msvcp140.dll
    • Size 540KB
    • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\vccorlib140.dll
    • Size 342KB
    • SHA256 6b8d8a76c3e6664293407553650e60b94df9aaafc7c92057ea83032bd228e44f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\vcomp140.dll
    • Size 4.3MB
    • SHA256 ef4f82968d2ab81e574d8cddd433c66190947ba5d28ca83bec8034d124a007dc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    discoveryinstaller

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral21behavioral22
    • Target
      HiBitUninstaller-setup-4.0.10\redist\2022\vcruntime140.dll
    • Size 120KB
    • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral23behavioral24
    • Target
      HiBitUninstaller-setup-4.0.10\redist\msvcp_win.dll
    • Size 626KB
    • SHA256 940a41d9d78c2d2d0ece8d8e4735630735f57ffb95466e350dae3535b40a698a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25
    • Target
      HiBitUninstaller-setup-4.0.10\redist\msvcrt.dll
    • Size 683KB
    • SHA256 744606e3d245647943ab7be0d4132ead491c719b908c207afb775e1ed30299f0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral26
    • Target
      HiBitUninstaller-setup-4.0.10\redist\ucrtbase.dll
    • Size 1.3MB
    • SHA256 5e7709a6b71bb818260b6f05c5bb3b6ca0c3ca9bc2f58c6242c1cd9d826d0079
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Authentication Package

1
T1547.002

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Network Service Discovery

1
T1046

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

installer
Score
3/10

behavioral1

discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral2

discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral3

discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral4

discoveryexecutioninstallerpersistenceprivilege_escalationrevoked_codesign
Score
8/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discoveryinstaller
Score
7/10

behavioral22

discoveryinstaller
Score
7/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10