General

  • Target

    https://cdn.discordapp.com/attachments/1301182305930313769/1301542688788709376/FREE_MS.rar?ex=6724db96&is=67238a16&hm=2f41aa7fe0e8af58166f775eb0618b450121d71ce720370c118d78c1b694dc28&

  • Sample

    241031-vjmxyszlhx

Malware Config

Targets

    • Target

      https://cdn.discordapp.com/attachments/1301182305930313769/1301542688788709376/FREE_MS.rar?ex=6724db96&is=67238a16&hm=2f41aa7fe0e8af58166f775eb0618b450121d71ce720370c118d78c1b694dc28&

    • Possible privilege escalation attempt

    • Loads dropped DLL

    • Modifies file permissions

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks