General
- Target Desktop.rar
- Size 3.4MB
- Sample260623-x65sdsfx9j
- SHA256 4b630ee7eed8927588e345077a8974f06b6f73918e077fa29d09e324a1b3d4fa
Malware Config
Targets
-
- Target CraftRise.exe
- Size 911KB
- SHA256 8faf0eac419869dd76d6930f47539b8d3c4d2a5d0c8afb8d1ff167261b183eba
Score4/10 -
- Target Process Hacker 2/ProcessHacker.exe
- Size 1.6MB
- SHA256 bd2c2cf0631d881ed382817afcce2b093f4e412ffb170a719e2762f250abfea4
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
- Target Process Hacker 2/kprocesshacker.sys
- Size 44KB
- SHA256 70211a3f90376bbc61f49c22a63075d1d4ddd53f0aefa976216c46e6ba39a9f4
Score1/10 -
- Target Process Hacker 2/peview.exe
- Size 229KB
- SHA256 4259e53d48a3fed947f561ff04c7f94446bedd64c87f52400b2cb47a77666aaa
Score3/10 -
- Target Process Hacker 2/plugins/DotNetTools.dll
- Size 132KB
- SHA256 b4cc0280e2caa0335361172cb7d673f745defc78299ded808426ffbc2458e4d9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Process Hacker 2/plugins/ExtendedNotifications.dll
- Size 140KB
- SHA256 61e8cd8de80a5c0d7ced280fe04ad8387a846a7bf2ee51bcbba96b971c7c1795
Score1/10 -
- Target Process Hacker 2/plugins/ExtendedServices.dll
- Size 136KB
- SHA256 5ae7c0972fd4e4c4ae14c0103602ca854377fefcbccd86fa68cfc5a6d1f99f60
Score1/10 -
- Target Process Hacker 2/plugins/ExtendedTools.dll
- Size 196KB
- SHA256 f2805e0f81513641a440f1a21057a664961c22192cb33fca3870362c8f872d87
Score1/10 -
- Target Process Hacker 2/plugins/HardwareDevices.dll
- Size 180KB
- SHA256 acd49f2aa36d4efb9c4949e2d3cc2bd7aee384c2ced7aa9e66063da4150fcb00
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Process Hacker 2/plugins/NetworkTools.dll
- Size 134KB
- SHA256 476aa6af14dd0b268786e32543b9a6917a298d4d90e1015dac6fb2b522cf5d2e
Score1/10 -
- Target Process Hacker 2/plugins/OnlineChecks.dll
- Size 222KB
- SHA256 7336d66588bbcfea63351a2eb7c8d83bbd49b5d959ba56a94b1fe2e905a5b5de
Score1/10 -
- Target Process Hacker 2/plugins/SbieSupport.dll
- Size 95KB
- SHA256 57c56f7b312dc1f759e6ad039aac3f36ce5130d259eb9faad77239083398308b
Score1/10 -
- Target Process Hacker 2/plugins/ToolStatus.dll
- Size 243KB
- SHA256 5713d40dec146dbc819230daefe1b886fa6d6f6dbd619301bb8899562195cbab
Score1/10 -
- Target Process Hacker 2/plugins/Updater.dll
- Size 110KB
- SHA256 0c11cdc3765ffb53ba9707b6f99ec17ae4f7334578a935ba7bcbbc9c7bdeed2e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Process Hacker 2/plugins/UserNotes.dll
- Size 114KB
- SHA256 fc9d0d0482c63ab7f238bc157c3c0fed97951ccf2d2e45be45c06c426c72cb52
Score1/10 -
- Target Process Hacker 2/plugins/WindowExplorer.dll
- Size 133KB
- SHA256 282696487ea5dc781788d5d8477b977f72b7c70f201c2af0cfe7e1a9fd8d749a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1