General
- Target _aba53ac926aec982a32be2012d84e931a4499d8bbc5c5c652fe3928c1132c134
- Size 10.0MB
- Sample260626-12khfae15z
- SHA256 aba53ac926aec982a32be2012d84e931a4499d8bbc5c5c652fe3928c1132c134
Score
8/10
Malware Config
Targets
-
- Target Check.wsf
- Size 12KB
- SHA256 7fd2a7e4824e8865bfc506cd3895719ff68d082910b619917fd09941ab96542a
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target Damned.dll
- Size 28KB
- SHA256 6d8bbe9c45a9380f0312740bd154bbdb88aca4183ab6aa7e15eb2b652f33c8e6
Score3/10 -
- Target FoxEnd.dll
- Size 1.1MB
- SHA256 68dcb7b0ddb39c45cc340bb52b69961a3865aa533ca8a49c22a7f0e3ad66a51e
Score3/10 -
- Target WINDBVER.EXE
- Size 30KB
- SHA256 8778bb953ffead733b53de1b4ac040061fd93e5bee5223893ca4e1dc7b0fea02
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target newdev.exe
- Size 66KB
- SHA256 1675b87be879b45739c08d9098ef754526ce032ea054ad754b2fef3efaff6ab1
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1