Overview

overview

8

Static

static

3

Downloads.exe

windows11-21h2-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Downloads.exe

  • Size

    462KB

  • Sample

    240701-m81w4syakh

  • MD5

    d3df85975c71ebf8a92b110e1d342ba0

  • SHA1

    fb1f0766f5b142dde9110abcc575d11d9a254d10

  • SHA256

    5e4413790351a032ceea226fa6f04286caebfe5d599ea80c0669169fccce56b8

  • SHA512

    bebbe543717004aff9f772a44e0d1c3fdae0e8050ed31c7fdab442399c2f4ef10d1659d7d57ee307396b210e3fc8e3ce2039b742839b22e4b9dc4a4daab339c4

  • SSDEEP

    12288:pyKxT6OuNHY3aF5g4Fw2Oo5l8TFEBANfO1qD2:pyKxWOuNHY3Og4S2O7hEBANfO1qD2

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Targets

    • Target

      Downloads.exe

    • Size

      462KB

    • MD5

      d3df85975c71ebf8a92b110e1d342ba0

    • SHA1

      fb1f0766f5b142dde9110abcc575d11d9a254d10

    • SHA256

      5e4413790351a032ceea226fa6f04286caebfe5d599ea80c0669169fccce56b8

    • SHA512

      bebbe543717004aff9f772a44e0d1c3fdae0e8050ed31c7fdab442399c2f4ef10d1659d7d57ee307396b210e3fc8e3ce2039b742839b22e4b9dc4a4daab339c4

    • SSDEEP

      12288:pyKxT6OuNHY3aF5g4Fw2Oo5l8TFEBANfO1qD2:pyKxWOuNHY3Og4S2O7hEBANfO1qD2

    Score
    8/10
    discoverypersistenceprivilege_escalation

    • Downloads MZ/PE file

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks