General
- Target jenniferloeffler.zip
- Size 3.0MB
- Sample260626-tpbanscx8x
- SHA256 ba182b9cc66dad0d74c298e31efb3447eee7da0f5f18b91f5d31bde59cd284a1
Score
8/10
Malware Config
Targets
-
- Target libiconv-2.dll
- Size 1.1MB
- SHA256 2e5883a09cfc4391cb81db3f0da4d9b8cda21fc1b287e73a1624ad518d941b94
Score1/10 -
- Target libidn2-0.dll
- Size 251KB
- SHA256 3ebaf0f048ad557c789c7602bbf0ff878b4e1c84b27fac559ad72c72259bd90e
Score1/10 -
- Target libintl-8.dll
- Size 301KB
- SHA256 a62094d6e21670f460cb110389d2cb7b9bc12cfbb075151eeb2c52436cc02755
Score1/10 -
- Target libpsl-5.dll
- Size 7.3MB
- SHA256 1edf77288976e898ae88fdc56a82d1bfe5dc81d6dbb171510de78059cdd1b9ea
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target libunistring-5.dll
- Size 2.1MB
- SHA256 35eae7305e2e108ec3eac677f3357e376247e77e32aaecbf818b2c68f134d91c
Score1/10 -
- Target psl.exe
- Size 64KB
- SHA256 68e81ce966ca0c016bb638d0d29b106a0da7eab2ddf70438d8182fa89baf5d78
Score6/10-
Adds Run key to start application
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1