General
- Target nitro free tool.zip
- Size 255KB
- Sample260426-n44ymsgz7x
- SHA256 d18b9793500bc3451746e05207d63cd68e7b3329ba3c0dc907e10800119a457a
Score
8/10
Malware Config
Targets
-
- Target nitro free tool/main.py
- Size 53KB
- SHA256 c06f7483cc8fbcd6fc402a5690f0b9f1db4eca5db1b61b66c11629da2868436f
Score8/10Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target nitro free tool/pyarmor_runtime_000000/__init__.py
- Size 103B
- SHA256 36ec246ab1810998c8e14455a9a4c4e593c4c73d368c6321c8e190518ae3b4de
Score3/10 -
- Target nitro free tool/pyarmor_runtime_000000/pyarmor_runtime.pyd
- Size 627KB
- SHA256 08e661d6b7f0aa69c36e5a62fe97d7e026841f1e64f0595d91c3cc61a5bb6cef
Score1/10 -
- Target nitro free tool/start.bat
- Size 123B
- SHA256 49bce604beef237d620ab11acedc72fdb2c0e63a0e3b5e7d1deefa11c3420a7f
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1