General
- Target sample
- Size 18KB
- Sample241120-xwpnes1qcy
- SHA256 961c58e8acfb2e8e79defdc4bca76cca7a1b35093cff40de257c0ad936ccd7c4
Malware Config
Targets
-
- Target sample
- Size 18KB
- SHA256 961c58e8acfb2e8e79defdc4bca76cca7a1b35093cff40de257c0ad936ccd7c4
Score8/10Creates new service(s)
Downloads MZ/PE file
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
Possible privilege escalation attempt
A potential corporate email address has been identified in the URL: currency-file@1
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Legitimate hosting services abused for malware hosting/C2
Mark of the Web detected: This indicates that the page was originally saved or cloned.
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1