General
- Target Anti Combat Log (ACL by GamerDos) v1.6.4.mcaddon
- Size 879KB
- Sample260510-vm34cafv2p
- SHA256 dc93099d624cdab8af47a3f076d8abed12e0def227dd7f3863a365654b192d15
Malware Config
Targets
-
- Target Anti Combat Log BP/scripts/main.js
- Size 92KB
- SHA256 b3101a3ea53eb22520a49f62d063c5dd891d70c3995c12f4c9de3329a60e4754
Score8/10Downloads MZ/PE file
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Modifies system executable filetype association
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Drops desktop.ini file(s)
Network Share Discovery
Attempt to gather information on host network.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
- Target Anti Combat Log BP/src/combatlog/events/afterEvents/entityDie.ts
- Size 644B
- SHA256 a6150b1bba6e80bc38cef0dd77020b542e2f12db249b87ee7b6640b52eed138d
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
5Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1