General
- Target @warp dox.zip
- Size 920B
- Sample260315-xpk2naby2z
- SHA256 8696df4a0d09fcaf1f7cad4cc9319434152c535b366430c15eb63edac8299704
Score
10/10
Malware Config
Targets
-
- Target @warp dox.zip
- Size 920B
- SHA256 8696df4a0d09fcaf1f7cad4cc9319434152c535b366430c15eb63edac8299704
Score8/10-
Downloads MZ/PE file
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
- Target faux dox.txt
- Size 60B
- SHA256 c7a52a98957b3b3b06bfd7a610de8189edf87e5e5314cd44743c1548442b1d57
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1