4321d0263aec6d704ddf0144257f8e08e1ccaf5a5515f4737fcdae942ab21b72

Sharing

Copy URL Twitter E-mail

General

Target
Pro.rar
Size 100.0MB
Sample260628-bep2zaex4z
SHA256 4321d0263aec6d704ddf0144257f8e08e1ccaf5a5515f4737fcdae942ab21b72
MD5 36f480f2e7ace2906315e8f6f7bd1cc1
SHA1 f104b1662735f31363b2b78d5722dce53c8b9a37
SHA512 70f08c60a3607b64c95e773fa79568e8918a34f9c3dd1e1dade0623eab327b298f3c294ad8867173eb339e9f3f0175292f1402078e802f5e6252ab7ed37c70ed
SSDEEP 3145728:WmtNIuXjS645maTdu24EyM1VwP0qhmUR7Lz:W1ut4XT8fE7VwP0zURb
TLSH
T1B13833C1CF75898ADA11F89E273DC7B46B5F441CB6A0D161B8F42DA5FA3A70D0E02B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Pro.rar
- Size 100.0MB
- SHA256 4321d0263aec6d704ddf0144257f8e08e1ccaf5a5515f4737fcdae942ab21b72
- MD5 36f480f2e7ace2906315e8f6f7bd1cc1
- SHA1 f104b1662735f31363b2b78d5722dce53c8b9a37
- SHA512 70f08c60a3607b64c95e773fa79568e8918a34f9c3dd1e1dade0623eab327b298f3c294ad8867173eb339e9f3f0175292f1402078e802f5e6252ab7ed37c70ed
- SSDEEP 3145728:WmtNIuXjS645maTdu24EyM1VwP0qhmUR7Lz:W1ut4XT8fE7VwP0zURb
- TLSH
  T1B13833C1CF75898ADA11F89E273DC7B46B5F441CB6A0D161B8F42DA5FA3A70D0E02B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  Pro/Capcut pro activator.exe
- Size 3.4MB
- SHA256 3566b18f74ed97ccb01c71ffcf36876979d282a9333af314b881bd0a977833af
- MD5 6979272f1d34b558fd32e301ff8aed98
- SHA1 fc2d82ff4525fbeaee2d2dfe96b9d1ef7f98f3f4
- SHA512 b1bc77efc2818bb0c9bcd3e7a3cee85239e6ac2f2ea070abb32130c553a7860e54c7d5e41c92d8aeb7310b80815de4262783778818023744b49cf774824159bc
- SSDEEP 49152:66FHzK4F7+Nk8plptZHwSnYxdFX7WnquqVFc+c0bJ+IYYoUTUi9:6MRdxz7WquimKbJ+IYXi
- TLSH
  T17DF57C47BCD188E6C0AAA73189B7659A3B70BC190B3227E32E50B6783F767C15C75B14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access discovery spyware stealer
- Suspicious use of NtCreateProcessExOtherParentProcess
- Reads WinSCP keys stored on the system
  Tries to access WinSCP stored sessions.
  spyware stealer
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unsecured Credentials: Credentials In Files
  Steal credentials from unsecured files.
  credential_access stealer
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral3 behavioral4
- Target
  Pro/chrome_elf.dll
- Size 2.3MB
- SHA256 db580e37cabd8a804e48ae9035383c6b7e3e9ddbc8d05abee242fd3c3ec7c8dc
- MD5 a141ce49faee3e4402ec7b22b2739bcf
- SHA1 42e56ef060a438591bb2642ff05b519bb2eb4b2c
- SHA512 81219091d8b95d7a8133e8434395b3770a9835e4fd82c234af2c346deaf3e9e570908390a0250e76c08cb898fe953b62cb9d5eafc5bcf9c587f74c1b86fe0279
- SSDEEP 49152:6aI8PLKkBrx52j5gjCOQ8fFp6nDIFazNBlPAHR:6aI8DF50g6MMDleR
- TLSH
  T1F6B57C13F2D901E8C05DC1798B5B9632EA61BC460B35B6DF0AA076161F7AFE4673E720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Pro/chrome_wer.dll
- Size 115KB
- SHA256 62c426bf55911b226b9a46c3b6ddcb58d8ad853fdd43a4f12d44750e31a5ce2d
- MD5 37a3059ff58213cc1fd854096d0d7e76
- SHA1 6e130c3c5b123e79c1ba588d19d1a8f6d90f298d
- SHA512 de9ec1368dc9eebc8866ded25a250392159ca20391eae334a7b8f3959345d4ad7beff34e5b1f188e5d2410d20946afde1096a981cf17f4fb69df88d58f96cab0
- SSDEEP 3072:snLR29KNnTNX3ZEng0j4RV4eWAtpFrpqpqpvIwT25k2hdW:sLR2aZZf0j4RVznMu
- TLSH
  T1ACB34A5763E900BBE5B7863884634F06EB72B8124761ABEF03A4421A1F637D15E3DB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Pro/concrt140.dll
- Size 324KB
- SHA256 5344e1f74334cce06b8cd14a901e27d29a1708c786fb7ad3281a00044205a051
- MD5 ae936484d159ba103c3b9b4a3c9d8d19
- SHA1 db719198108130aa109964ea6cd544f912735a53
- SHA512 d108b816f85c758b5dda1a22e761f607428e4a0e54f46a9e33b6fdd67c27dd4151a75091510eb8091924ed703dcba26db2f6bb5c74b5fd58e104ed42d8e05637
- SSDEEP 6144:lpxc5oSb/fSpwaxspxI6CLwaVInWzgFYxNxKYSF:lPc5oSDfStI7qz3lPE
- TLSH
  T16C643A8A76580CE6EA67D039C693C50BE6F3B9452352C3CB1364938E5F677D0D83A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  Pro/d3dcompiler_47.dll
- Size 4.5MB
- SHA256 464ac23f4a5e5d92a9e99f92641f3a0c5e8326b378a45140dd9f880686b9d1e9
- MD5 fe8b95e5941a2112c16858945f952d8f
- SHA1 72325b2fe4e1a6d3a3f7b623843eeb61c9162300
- SHA512 9d4a00e30c15af6fe0cf6a9b2d4671c7f826c4b2b048442d0b889302ce06410c4b4d4760f19eaf3c6ddeaaff31738dd8f0461d422c180bd64389658f7c5c5220
- SSDEEP 49152:h6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/B:hUdeqt737jFm5w5
- TLSH
  T109268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Pro/dual_engine_adapter_x64.dll
- Size 5.1MB
- SHA256 d5ec2ca6c7c116f57f45b3a80a99664b68f02be305d8d41427f4af877421011f
- MD5 28a22c699f09dba495f45c6ad3f2ed82
- SHA1 461337b7cba23c02a856e426abac1b7c6b9d3691
- SHA512 964dab1d13df07b4f0e69517779d5ed71f682e72651e2b6fec268ddf9fcf2cc02e18d6cd2d003d442191821338f0797114632e28a7c90871b513aef1b9079af6
- SSDEEP 49152:9IrYTlptJDw/NIbupGgQ4HZBlubdkD3TvvOuXuGv2MfvfkMNODsgXmcCxOJm4wwL:5rIl8cFNF7Rknrz64Z
- TLSH
  T1BD365B53F29611B9C00ED9B88B2F5632A5647C4A4B31A3EF0AE936210F75BD85F3DB14
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Pro/dxil.dll
- Size 1.4MB
- SHA256 3855461625ced4bfc89171ef465b398f75ce1bdef4fc565d850159e35341744a
- MD5 209b426f1b967f86e5de49232d57983d
- SHA1 21ee8b869ec33bbdc097e47847efd2af5f8c6136
- SHA512 c83eb25ad7b7f2365af99fe126cabbb140ed373b0ea82fd73414fb2fcf68a71b0607b13095e258d63d8ebcba70f64ac2dd2ce66a7672686a041c255fd5d08d73
- SSDEEP 24576:ycuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/c:ysHMPzbOxBduHdSCde8ZF1/0Wy4oV6bB
- TLSH
  T11E657D6B66A800B9D4BFD174CA438E0BE7B2B45503B0EB8F16F442A61F577B15A3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  Pro/eventlog_provider.dll
- Size 15KB
- SHA256 ab44220f0647d6d1a5df27d11be725a937b1a096b620638bacef5ad01db50646
- MD5 f1713aa15b05fa70bc45d6eb186e651f
- SHA1 663163f56f6829b2884cb109c68aa566914e5770
- SHA512 4e70ef67f7b3492e7dc842b3486ce2ecf845f135426a2fb94514b74ad083b4fc60142dca7e2a3afab0a3a4b9dea3fd7fc9f4d6682e8520139963296c73f825e4
- SSDEEP 192:1qqnWd0LVWc6Wz2DWHbNpofeBWseaAWzQcNpcspKLX01k9z3AbJ98Jt:NWd0LVWcr2y4GlNSscmeR9z+Jy
- TLSH
  T1187229D697A88502FD9AAEB052B8CD533D3CB7C21B1096DB1682F0581C627C4FF3066E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13
- Target
  Pro/ffmpeg.dll
- Size 2.9MB
- SHA256 2709ac9a18ec0aaefeab7e096db7cb7c06f7f87e1026d84b15579e2631662a25
- MD5 094ca551121772f22ffa0640ac658796
- SHA1 c657f698c435f2b7fa3662f66f9fca6ff0eb321c
- SHA512 f019ee2f6b334bbc972020dc91f1c138405b76c49ead9dffc15554ae5f204401c61780dfdb007cdce4866f699e22f5915556ccf4306df6c32b4feae52651988f
- SSDEEP 49152:RoZr/c81IQbx6i1N28c18oSh9aLuS6FnFizu6vIGqB9OG+CJtcjA5m:RoZr0iaLu/ivvO9bD
- TLSH
  T17CE59E02F6D251EDD019C03497ABE213F271780A4F205AEF17A05A253F66FE86D7E768
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  Pro/libEGL.dll
- Size 499KB
- SHA256 6397808c0745f08bc971dcf1eda61deb164d9c372dc6d5dd2fe8eccbdb7fc341
- MD5 2623d37b55bf9369f42d2a5a70ee51b4
- SHA1 78898fb21c20e085c34dfff9822fb05e9831fc77
- SHA512 ed75b7a6845175cd32a5e4fd6e091b41d6eb4f68139ea37d7a4207919d10e722d9508a512be6581114ad28e6411ec9ad1a35818e41aae05baba0e29277f11260
- SSDEEP 6144:ngfx9w55AkgG95e1xnaEjbiKaU3kQaJjkcWcfRYCx9/pt/BCSKxJIUgq9WXA:n15z5kbiokQaVkcWcfuCpCSKxuA
- TLSH
  T1A7B48E16B3D849A9E07AC038CA438547DA7178460B75F6DF02D0E27A2F77BE46A3E315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15
- Target
  Pro/libGLESv2.dll
- Size 6.8MB
- SHA256 dca8d78efd1cc0823c3b044ddc8043035e2e21467705e140a6409d732eb23670
- MD5 155b895c53f0a3aa401f9e4850636fc1
- SHA1 316bb486a4b2eda476e5e9e3eb29814bc115d69d
- SHA512 61c90a3d045895cbc9395b541dc247c312a8338a802b68eb1426aef3572639f0849d4d05459529b900d40445eb3b345564f4a952c15874a9d92ce3c84d339361
- SSDEEP 98304:Z/4bGKn5Ot8E8LQIpKeZJD4ZoLS1ckAC/67:FluPZUWS/i7
- TLSH
  T162667C03F29681C9C01DD274976B8623F635BC850728B6DF269457212FBAFE0AB7E714
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  Pro/microsoft_shell_integration.dll
- Size 449KB
- SHA256 d1fc28030b6e9974cfd71a3bd6fab0d5e3f31b375573f0d10ff957ac4146ef00
- MD5 775a61324343c32907ca4fcc3b980e19
- SHA1 573b39ad61639257448a1e4908c5ab1f3d0ecd0f
- SHA512 793b20a0e450760aae0a740d49695552846597a1e4ff5f733aa20e1bd686c439471da069f58ac3fb2b3f677a5ef0fb75730e9cee4538d264b773690465b6f992
- SSDEEP 6144:unFPvNtCHUcKTmUAh9dPQ0w7lWYHE35zmxIlD40RLtMFN:unFPvXOKiVY7lWYHE3RmxIlD/+N
- TLSH
  T151A48C05B7E448A9E076C138CA538546EB717C960B71E2DF03A0E2692F77BE45B3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  Pro/mip_core.dll
- Size 5.2MB
- SHA256 b91132b09bccc01df0d0a168691bb9e3720d7a5c0f69f1fd838ea6f87cceab0d
- MD5 0622b767e9e89eb0edba095d3219d660
- SHA1 6af7744dfa8af85bc2d54954f1586e968dd2a3ec
- SHA512 2e0562acfd3faf7e102cc1380df05efba88fe29f95333cbaf1cca44b44a4070ea0bd056ec6ab7ece86b921a35ce5b50708c68a3a9f427ec35349d9c0e412591c
- SSDEEP 49152:DuBYH146Mvl8bR+WM7ZvaL4Zrzi8n8sJsRrlurPuTtuGKc7mhT5Ci6uBtiLVja3c:/14lLfzhuTJytXiYjGPwaWu
- TLSH
  T12D467C57B7A800ACD4BBD27D8A4B8507E7B2B806573197DF02A0577A1F67BE15A3E300
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18 behavioral19
- Target
  Pro/mip_protection_sdk.dll
- Size 2.4MB
- SHA256 3e46c961339de0359adc33e27aeaba932fb609304bc764aa0fa49b7d11dcfd78
- MD5 17ac1c062c43f00b3ebe5bb15f866a5e
- SHA1 9f8f3001e81b4d64a1833e071782f22caf44d7ba
- SHA512 6a57422a0f6e0cfdc18b1a57b3153d4b2179c8a79125e9547ffe7158356dbd580bd664d0336a3e33a95d39343b0216b49a794c8506670109876e58bce750b51b
- SSDEEP 49152:OxFDqq8uX+lXcW9vDbslAbjE/rHnULSv+F6i8a3isHp:r1Wmp
- TLSH
  T182C53C477A554099C1EBD2B99B1BC943F234744A0334BAEF039097572EDBBA0AFB9311
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20 behavioral21
- Target
  Pro/msedge_elf.dll
- Size 4.6MB
- SHA256 20150099f08f29714d52137f6d2b9e9799bc031c4f7228912772643d2e634bc3
- MD5 ea68c6ee94337a94f8a3d461f1d67917
- SHA1 5e058eeb6f47f8a0053ca453db506482ea590021
- SHA512 b54651c5d58b7bda94d89ca328bc4f9130ef5ebcb04cea721cbf4a32d3c24eb7173a3ad3dbbec5695a8ad3b5ae7471456681d03941bf0155bac35dbd09863722
- SSDEEP 49152:3FG9S61PDnfxmn2i6TYTcNVoWc5mpJ9QTj2rTGCVOxZzZwY9mJWuoowUzdtYgdZv:Turyf9iTAPEnwc39tRVye
- TLSH
  T1AD264A43F25211B9C44EC8B4CF2E552297643C8A4BF193FF25E83AE11A75AC97739B24
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  Pro/msedge_wer.dll
- Size 115KB
- SHA256 6d5ccc1720656ece210fb98641a4002409d0b9900d3cd9fec911b526a97aac43
- MD5 be1d7da17218e3d786bb45fe8453b85c
- SHA1 a767dbbbdd063c7122d50e93e0a769489d48b0c4
- SHA512 cd6f0fd0e45e0025446ad5736a6486f7a0cbc8a3caf1102e376979256ed3a377d2a5e74fa32824c7df38171ffa1cb3742076de053b12f1569245a7e1776f84c0
- SSDEEP 3072:k7RSOBa1Trm0O31k0IeYIycAtpFrpqpqpvIwT2UczzYafHPBA:iRSAsv4k0IeY3hIfYh
- TLSH
  T1B8C36A5763B900BBE177863885634E45EB76F8118720ABEF03A0425A1F637D19E3EB71
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  Pro/mspdf.dll
- Size 18.4MB
- SHA256 52c9c7b146d5d747e113b4b35cb4c703162f2d985ea242ec4291db54f7377bf5
- MD5 b0785c4d57214a791643ba9d59549cf8
- SHA1 35fa9f69941fce1d1a29aee164bc956f82b87aaf
- SHA512 bd568668ea2b5ed5a93504de2091ad845d4a27c28deb330752d9392d30d149b313a6f59cc133d0777483099b71300ad11916da8514dd8081decbdc09e7855961
- SSDEEP 98304:yK20/CdTySbSI8/tkyTQQv/45Ok16RMBQjhWOvPy/UO0JV6xEnwjql1UntpC4X0I:yOTTQQv/45OkMK/7Y6x9bX
- TLSH
  T1C6176D06BB9A49EDC04CC874934B86535E20B8CB0B75E5EF45C962192F7ABF85F3A314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  Pro/msvcp140.dll
- Size 550KB
- SHA256 f23ec08cd51a0377de3d5e15265f28696e3602270df6f9057ace13a26d9a48bc
- MD5 ce4433a1b66d6e3f123d4853ab31b79d
- SHA1 1c5d64e4f7147928835e7b3260d81cf448a651a0
- SHA512 5d933333a69ae1f12ab1aeab822caf5f975a685464d782f8b582b92e84a331ccc80258dd3251016f73561dd3cbb0872b5d781b2d30dba96451ff5da388fd483b
- SSDEEP 12288:K0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7h:K0p1F/IiQEKZm+jWodEENh
- TLSH
  T1C7C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  Pro/msvcp140_codecvt_ids.dll
- Size 40KB
- SHA256 3ad45d2800f13e5bedeb1e0fddfcd40c392622bb8649c4321992d097941518de
- MD5 74e1f207b7097f6a35cb073e948fca20
- SHA1 f8d00e910218659f08301761bbf4703e29958109
- SHA512 b68dde42ca484a498a9f7b56090dc6d73960cdc0dc75e47c334883a780b6747d32204733a719292c2d38be1b6b8b27485f0f2dd8c332ece40a4f070b99741fc2
- SSDEEP 768:2wA1mjzzGgU9IX+09zo8AjCf9zcfFJq09zoL:2wA1SzzG3e+czopjozM8czoL
- TLSH
  T1B8137DDADA788083EEDB5DB082A8DE877C3CA3C70A5095A71362F1540D537C5EB3426E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral27 behavioral28
- Target
  Pro/oneauth.dll
- Size 5.7MB
- SHA256 adf8a824a06c62fe92efb03ea07423e182609017f44e6a1ecc965a63e4513bd9
- MD5 c2de63ecf27c2c67943dde631298eca2
- SHA1 0f9d0309ebde88c473abd5498f2900461fe1107b
- SHA512 5467496f65cf578ae26c3b314d42378cc6a76bef435ac306dde5b5918f8ed08b2857f3720a5ce243345ae40a05bd7002214401df6de39d2aa02db526827a99fd
- SSDEEP 49152:YIphIXwBuXtFtLQQqB76mf8oR6L9BW0JOBKSTaCYgzyTMbKfujWZZmEDxP3AmT5f:Yo8o0/FQ0Mc9Aua6/3LLgtkt
- TLSH
  T112564B017ACBE598C0DAC47056438513AE507CDB0B39E9FF01E1F15A3FBAAB45FA5229
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29
- Target
  Pro/oneds.dll
- Size 3.2MB
- SHA256 af48988967bae769f3031f0d9fabc5ff7bdda72e8224050190a16988de21e611
- MD5 d2fd39d1eeb4f74da30d0e4a0c4a701c
- SHA1 0efaf97c0a7f477e4d9502b9ed168691c57eac78
- SHA512 8cdfd1cd1104fb34902ad1f15770fbdd21fca07b94658f21d37d7b55e7ec0c0ea6f35ae483d76e08fe6b760fec64e5030232b4eb63662376a4b2d7785d4503df
- SSDEEP 49152:oeqnNyCB3ocUrGaXdWycnZT+S2cKrVRzTMyBf4MVOZtDc:zq4XM7VcZRfceOZBc
- TLSH
  T1B1F56B03FA5641B9C08AC174C7678733AA713C8A4F74A6EF06A856153F7ABE05B3D358
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral30
- Target
  Pro/onnxruntime.dll
- Size 3.1MB
- SHA256 1f11ded7a52be5994c8944ce4bd44d82e0a63c955688aa8e727cf22a9c65a42e
- MD5 f17a75200adbc2ee4ed315d7cedadc66
- SHA1 2cd0cb4e486ba2955f87d2faa3897d31ba15f6b5
- SHA512 488241130a49b82e988bac83932334305c2bbe5b5fb73a1cc0ac03811d577f78bde287695702b208bed5d9c2b1708c41ccbe984fa777110ee9569ec72f95be74
- SSDEEP 49152:89dUKzyhC/ni1yzbArKqzr/fpSILTSPtBgwZ4iruMF/cH9nmoh9kXpw9XpzwYMNg:VgBm
- TLSH
  T154E5AE2AA3E802E8C07FD179CA4B8A17EBB27449C3705AD703F185552F6BBE0567E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Reads WinSCP keys stored on the system

Reads data files stored by FTP clients

Reads user/profile data of web browsers

Unsecured Credentials: Credentials In Files

Checks installed software on the system

Suspicious use of NtSetInformationThreadHideFromDebugger

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32