hxxps://gofile[.]io/d/Dud86E

- Target
  
  https://gofile.io/d/Dud86E
Score

8^/10

google discovery evasion phishing
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Detected potential entity reuse from brand google.
  phishing google
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Loads dropped DLL

Checks for any installed AV software in registry

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Detected potential entity reuse from brand google.

MITRE ATT&CK Enterprise v6

Tasks

static1

urlscan1

behavioral1