General
- Target TheHeadmaster.exe
- Size 102KB
- Sample240427-cl33vagh67
- SHA256 19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
Score
10/10
Malware Config
Targets
-
- Target TheHeadmaster.exe
- Size 102KB
- SHA256 19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
Score10/10Modifies WinLogon for persistence
UAC bypass
Disables RegEdit via registry modification
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Registers COM server for autorun
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Drops desktop.ini file(s)
Legitimate hosting services abused for malware hosting/C2
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Tasks
static1
Score
3/10
behavioral1
Score
10/10
behavioral2
Score
1/10
behavioral3
Score
1/10
behavioral4
Score
1/10
behavioral5
Score
1/10
behavioral6
Score
1/10
behavioral7
Score
1/10
behavioral8
Score
1/10
behavioral9
Score
1/10
behavioral10
Score
1/10
behavioral11
Score
1/10
behavioral12
Score
1/10
behavioral13
Score
1/10
behavioral14
Score
1/10
behavioral15
Score
1/10
behavioral16
Score
1/10