hxxps://p1ioog[.]by[.]files[.]1drv[.]com/y4mscteZ6Ipn6hnwBgcScO-xNivxWmJrorzsQpqhL3tKmeZdwXbJmQCPIam5jKw0YFhJmUeenDPMNmpDCk2Bmkr0TjlbQP6GVdBZWcFb43gX3vvphe1cObBYnDrPDlw6G1UZGpngjtZ-X8B3TLgtjwAMEUH4X4rEBx4AWHaFlhsTCMifMnHK6nMZdtXmD-ilntJPKDdkluOTxvle_CBISt0DQ | Triage

Sharing

General

Target

https://p1ioog.by.files.1drv.com/y4mscteZ6Ipn6hnwBgcScO-xNivxWmJrorzsQpqhL3tKmeZdwXbJmQCPIam5jKw0YFhJmUeenDPMNmpDCk2Bmkr0TjlbQP6GVdBZWcFb43gX3vvphe1cObBYnDrPDlw6G1UZGpngjtZ-X8B3TLgtjwAMEUH4X4rEBx4AWHaFlhsTCMifMnHK6nMZdtXmD-ilntJPKDdkluOTxvle_CBISt0DQ
Sample

240512-v2h2qagc6s

Score

8^/10

discovery persistence

Malware Config

Targets

- Target
  
  https://p1ioog.by.files.1drv.com/y4mscteZ6Ipn6hnwBgcScO-xNivxWmJrorzsQpqhL3tKmeZdwXbJmQCPIam5jKw0YFhJmUeenDPMNmpDCk2Bmkr0TjlbQP6GVdBZWcFb43gX3vvphe1cObBYnDrPDlw6G1UZGpngjtZ-X8B3TLgtjwAMEUH4X4rEBx4AWHaFlhsTCMifMnHK6nMZdtXmD-ilntJPKDdkluOTxvle_CBISt0DQ
Score

8^/10

discovery persistence
- Registers new Print Monitor
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

discoverypersistence