General
- Target EA DLC Unlocker v2 155-0.zip
- Size 245KB
- Sample260628-ppfsyaht4l
- SHA256 5410236d86e3f1296466ae18cd326a987bb3ff43bbd94d3fee26e57710fb6f7c
Score
8/10
Malware Config
Targets
-
- Target EA DLC Unlocker v2/ea_app/version.dll
- Size 239KB
- SHA256 70553a2b4d53eddf1eeb290e346a9b562c71f52d46874bfb708e9d962469a736
Score8/10-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target EA DLC Unlocker v2/origin/version.dll
- Size 188KB
- SHA256 cf784476719a93e3fb8457a2d4c4580b691b6d04592b9a4467acf563f30d2b83
Score3/10 -
- Target EA DLC Unlocker v2/setup.bat
- Size 14KB
- SHA256 d57693f225f6cb6db126f7f5159a7d2b5631b11a1b4659faefcf6572e55517c0
Score1/10 -
- Target EA DLC Unlocker v2/setup_linux.sh
- Size 10KB
- SHA256 b6b4797b1ce41e14b7c3e8c2a601d3487fd5d4d01477c2ef405b9c4529f1b1f6
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1