General
- Target 17UJJZ15N57GG_19SYPURD17668_windows_x64.msi
- Size 3.2MB
- Sample260426-w2j5fset9w
- SHA256 6fb49f3d58126be5407300fffea3fee7ec5d05ff6e8ecb27457a8ca3c335dfeb
Score
8/10
Malware Config
Targets
-
- Target 17UJJZ15N57GG_19SYPURD17668_windows_x64.msi
- Size 3.2MB
- SHA256 6fb49f3d58126be5407300fffea3fee7ec5d05ff6e8ecb27457a8ca3c335dfeb
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Msiexec
1