General
- Target LDPlayer9_ens_1001_ld.exe
- Size 3.4MB
- Sample260623-m5373act2s
- SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
Malware Config
Targets
-
- Target LDPlayer9_ens_1001_ld.exe
- Size 3.4MB
- SHA256 8514265546d0df203b0dbf8b6b68d3b699fe6efe2d671638daee94de07b0816b
Score8/10-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Possible privilege escalation attempt
-
Creates new service(s)
-
Modifies file permissions
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
File and Directory Permissions Modification
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1