General
- Target Capatacion_de_Mexico_Ciudad_Lluvia_Sistemas_a_2.8.zip
- Size 571KB
- Sample260622-rrgt5ads2s
- SHA256 c7444cedeabe29dd2b3c7f9654f7196a15ee31b883298c45e24824cbb056d846
Score
8/10
Malware Config
Targets
-
- Target Application.cmd
- Size 30B
- SHA256 b0f0b6e38f77c518ebfaf691d729636d82cc59dc2a329d7454e11f74a2cb2d3f
Score7/10-
Executes dropped EXE
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
- Target package.txt
- Size 302KB
- SHA256 830ec7352972fd1eb24fcaf72349ef9a27dd9f26f24552d6b68b87ffeada1212
Score3/10 -
- Target unit.exe
- Size 852KB
- SHA256 bbd438d3d7a59152f1dd5e45bb8d22ee1c07f95cfe42cebbe756aaf4feadc875
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1JavaScript
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Scheduled Task/Job
1Scheduled Task
1