General

  • Target

    https://web.archive.org/web/20160602102617/https://www.microsoft.com/en-us/download/confirmation.aspx?id=18481

  • Sample

    250412-qlqz6svp13

Malware Config

Targets

    • Target

      https://web.archive.org/web/20160602102617/https://www.microsoft.com/en-us/download/confirmation.aspx?id=18481

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Use of msiexec (install) with remote resource

    • Blocklisted process makes network request

    • Detected potential entity reuse from brand MICROSOFT.

MITRE ATT&CK Enterprise v16

Tasks