General
- Target SteamSetup.exe
- Size 2.3MB
- Sample261029-ycaktsswft
- SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
Malware Config
Targets
-
- Target SteamSetup.exe
- Size 2.3MB
- SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Modifies file permissions
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Deletes itself
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 110KB
- SHA256 c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 22KB
- SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
Score3/10 -
- Target $PLUGINSDIR/nsDialogs.dll
- Size 20KB
- SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 17KB
- SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
Score3/10 -
- Target $PLUGINSDIR/nsProcess.dll
- Size 15KB
- SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
Score3/10 -
- Target Steam.exe
- Size 4.2MB
- SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
Score9/10-
Renames multiple (6105) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
- Target bin/SteamService.exe
- Size 2.5MB
- SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
Score1/10 -
- Target uninstall.exe
- Size 155KB
- SHA256 72ffe8859eaa63637f5a62b7c454241db35938f8326f6ccf20352e00f8df2fe5
Score4/10 -
- Target $PLUGINSDIR/LangDLL.dll
- Size 16KB
- SHA256 4fca692a36f0c99e26b5bc7ef9db5269d2c1e21288184953898130fea9b1c4fc
Score3/10 -
- Target $PLUGINSDIR/ShellLink.dll
- Size 15KB
- SHA256 eae7829a3df5d8d63e16787f7c3d5ae4b82b3b79c2cd7aad9c2532374b6ea522
Score3/10 -
- Target $PLUGINSDIR/nsExec.dll
- Size 17KB
- SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1File Deletion
1Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2