General
- Target _74d799fc4c37d42c52ea29f4d18fe588dafc2ff7c23cdf19e7ce8f7fe75be897.txt
- Size 5KB
- Sample260604-llql7acz3r
- SHA256 74d799fc4c37d42c52ea29f4d18fe588dafc2ff7c23cdf19e7ce8f7fe75be897
Score
10/10
Malware Config
Targets
-
- Target _74d799fc4c37d42c52ea29f4d18fe588dafc2ff7c23cdf19e7ce8f7fe75be897.txt
- Size 5KB
- SHA256 74d799fc4c37d42c52ea29f4d18fe588dafc2ff7c23cdf19e7ce8f7fe75be897
Score10/10-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2