General
- Target TheHeadmaster.exe
- Size 102KB
- Sample240427-cl33vagh67
- SHA256 19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
Score
10/10
Malware Config
Targets
-
- Target TheHeadmaster.exe
- Size 102KB
- SHA256 19390c0eedcd974e57a13cc03f78454f6de4e2f36d85f412249d1c04841dd0ec
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Tasks
static1
Score
3/10
behavioral1
Score
10/10
behavioral2
Score
1/10
behavioral3
Score
1/10
behavioral4
Score
1/10
behavioral5
Score
1/10
behavioral6
Score
1/10
behavioral7
Score
1/10
behavioral8
Score
1/10
behavioral9
Score
1/10
behavioral10
Score
1/10
behavioral11
Score
1/10
behavioral12
Score
1/10
behavioral13
Score
1/10
behavioral14
Score
1/10
behavioral15
Score
1/10
behavioral16
Score
1/10