General
- Target 28062026_0836_Q26072WR1-TS.js.zip
- Size 2.9MB
- Sample260628-khv7tsgs2y
- SHA256 45113c3811e72738089a8abfc1ca425640ec6ff8df46f1331d218d7dd40427b8
Score
8/10
Malware Config
Targets
-
- Target Q26072WR1-TS.js
- Size 4.1MB
- SHA256 75992de9fce67084b11ff0872cbc63b5625d0822a07dfc4f44b1df5294c2d910
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Uses browser remote debugging
Can be used control the browser and steal sensitive information such as credentials and session cookies.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Modify Authentication Process
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1