Extracted

• • Target

    https://cdn.discordapp.com/attachments/1255657489744138303/1256354654938337421/NightSchoolBeta.rar?ex=668319f3&is=6681c873&hm=4630951fe40c6485b6756c7109464fea83f19ee22d0a6e419bfdcdc912105476&

  Score

  10^/10

  discoveryexecutionpersistenceprivilege_escalationspywarestealer

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • An obfuscated cmd.exe command-line is typically used to evade detection.

  behavioral1