Overview

overview

8

Static

static

3

mainscript.exe

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mainscript.exe

  • Size

    30.5MB

  • Sample

    241120-f62massgjm

  • MD5

    e246ad42bcfcd8e9c7cb7da499604fa9

  • SHA1

    49d5dca6dac05433f5106468bcd53a5bd084826b

  • SHA256

    ab56e96a36ccb3320b251f269f664c1cbba7ac640dba72a5e8f8c42ff0e6abf5

  • SHA512

    4bdf8cb99a4c3e1cb9273118d19eeef03b0e1de12b5407b198e255b7f9d63147aac2f1ed7c4c00bd2e9af34e89d25ca5866e6691196ab4008ee20f456d2735ba

  • SSDEEP

    786432:if9Yi8MkQ1JnW828P51QtIbSw1JIxHEha8DZcQl82BD0DI/U:u9SA1Wr8PXiI2gNs6O2p5

Score
8/10
executionpersistencepyinstaller

Malware Config

Targets

    • Target

      mainscript.exe

    • Size

      30.5MB

    • MD5

      e246ad42bcfcd8e9c7cb7da499604fa9

    • SHA1

      49d5dca6dac05433f5106468bcd53a5bd084826b

    • SHA256

      ab56e96a36ccb3320b251f269f664c1cbba7ac640dba72a5e8f8c42ff0e6abf5

    • SHA512

      4bdf8cb99a4c3e1cb9273118d19eeef03b0e1de12b5407b198e255b7f9d63147aac2f1ed7c4c00bd2e9af34e89d25ca5866e6691196ab4008ee20f456d2735ba

    • SSDEEP

      786432:if9Yi8MkQ1JnW828P51QtIbSw1JIxHEha8DZcQl82BD0DI/U:u9SA1Wr8PXiI2gNs6O2p5

    Score
    8/10
    executionpersistencepyinstaller

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks