General
-
Target
https://hybrid-analysis.com/sample/255c9bb9a555afdc1c33193a47af2ec81d1e949b34b0a28f15937f2d14d0d019
-
Sample
250108-z9z3eswqbp
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hybrid-analysis.com/sample/255c9bb9a555afdc1c33193a47af2ec81d1e949b34b0a28f15937f2d14d0d019
Resource
win11-20241023-en
Malware Config
Targets
-
-
Target
https://hybrid-analysis.com/sample/255c9bb9a555afdc1c33193a47af2ec81d1e949b34b0a28f15937f2d14d0d019
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1AppInit DLLs
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Accessibility Features
1AppInit DLLs
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5Subvert Trust Controls
1SIP and Trust Provider Hijacking
1