Overview

overview

8

Static

static

3

NewLifeRol...up.exe

windows11-21h2-x64

8

$PLUGINSDI...up.exe

windows11-21h2-x64

6

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDI...st.exe

windows11-21h2-x64

3

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...id.ps1

windows11-21h2-x64

6

$PLUGINSDI...86.exe

windows11-21h2-x64

4

launcher/n...er.exe

windows11-21h2-x64

6

launcher/w...QB6.js

windows11-21h2-x64

3

launcher/w...x.html

windows11-21h2-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    NewLifeRoleplay-Setup.exe
  • Size 146.1MB
  • Sample261029-zar8jaex2x
  • SHA256 57f6b4c1c9073e3cf9b4c50e48687b4bdd73916aa61cc229c6ca58d80bb7cab3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojan

Malware Config

Targets

    • Target
      NewLifeRoleplay-Setup.exe
    • Size 146.1MB
    • SHA256 57f6b4c1c9073e3cf9b4c50e48687b4bdd73916aa61cc229c6ca58d80bb7cab3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwaretrojan

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Drops desktop.ini file(s)

    • Network Share Discovery

      Attempt to gather information on host network.

      discovery

    • Drops file in System32 directory

    behavioral1
    • Target
      $PLUGINSDIR/MicrosoftEdgeWebview2Setup.exe
    • Size 1.6MB
    • SHA256 e99838c51bb3379b244654aa77e33032d42fc2b5d224c5babce432d9fd3dcb28
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discoverypersistenceprivilege_escalation

    • Event Triggered Execution: Image File Execution Options Injection

      persistence

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/dxredist/directx_Jun2010_redist.exe
    • Size 95.6MB
    • SHA256 053f76dcbb28802e23341b6a787e3b0791c0fa5c8d4d011b1044172dbf89c73b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 715a9b58de0995d1a08384c522ad9af210e2791aaf8e87a6c07bfe72ebfd2cb5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 7KB
    • SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral6
    • Target
      $PLUGINSDIR/set-lnk-aumid.ps1
    • Size 5KB
    • SHA256 be2cfd3368b2ec500ed6244f1df7b9da4835486f38171dcd58c400af50f6ae30
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    execution

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral7
    • Target
      $PLUGINSDIR/vc_redist.x86.exe
    • Size 13.3MB
    • SHA256 0c09f2611660441084ce0df425c51c11e147e6447963c3690f97e0b25c55ed64
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral8
    • Target
      launcher/nlrp_launcher.exe
    • Size 608KB
    • SHA256 1fd150973d6587888c9bf7ae3ceb228228180ec879c7e7d796a074bc37110546
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoverytrojan
    behavioral9
    • Target
      launcher/web/assets/index-CebXhQB6.js
    • Size 192KB
    • SHA256 eb740d9ac73199b94c7f01c83ef19061da1306d8a9bfbefb1c841bdf55a35e42
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral10
    • Target
      launcher/web/index.html
    • Size 413B
    • SHA256 4ee160da508f0c3a6ed646eb7bc69210a987af549872cc8891d9de4cf682d951
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Image File Execution Options Injection

1
T1546.012

Defense Evasion

File and Directory Permissions Modification

1
T1222

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Browser Information Discovery

1
T1217

Network Share Discovery

1
T1135

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

2
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks