General
- Target SecuriteInfo.com.Win32.Malware-gen.63978713.exe
- Size 1.9MB
- Sample250827-vzelhssthv
- SHA256 ef69941b32be75da6500aa8a2c210bbc0470947c720a526f926f6a2c77141711
Score
10/10
Malware Config
Targets
-
- Target SecuriteInfo.com.Win32.Malware-gen.63978713.exe
- Size 1.9MB
- SHA256 ef69941b32be75da6500aa8a2c210bbc0470947c720a526f926f6a2c77141711
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Modifies trusted root certificate store through registry
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates processes with tasklist
-
Suspicious use of SetThreadContext
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
Score3/10