General

  • Target

    https://check-cf-ver1.b-cdn.net/version3/cf-check.html

  • Sample

    241120-xvkm3s1qbv

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://benetinc.com/next/zukaz.txt

Targets

    • Target

      https://check-cf-ver1.b-cdn.net/version3/cf-check.html

    Score
    10/10
    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks