General
- Target itop-easy-desktop-4-3-0-342.exe
- Size 105.6MB
- Sample260623-ca8h7aas6w
- SHA256 2460bc2c81daed88b4edbf437efb61a2cd7fad5a7ae14c13a138b98620ca9d80
Score
7/10
Malware Config
Targets
-
- Target itop-easy-desktop-4-3-0-342.exe
- Size 105.6MB
- SHA256 2460bc2c81daed88b4edbf437efb61a2cd7fad5a7ae14c13a138b98620ca9d80
Score7/10-
Creates new service(s)
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Component Object Model Hijacking
1