General
- Target DeviceHost.exe
- Size 780KB
- Sample260629-fa2mesds7t
- SHA256 74dd8cdc532329315bf12d2ad2376d5ad0eab28f25a931911bdb23264ad9e3e2
Malware Config
Targets
-
- Target DeviceHost.exe
- Size 780KB
- SHA256 74dd8cdc532329315bf12d2ad2376d5ad0eab28f25a931911bdb23264ad9e3e2
Score9/10Enumerates VirtualBox registry keys
Looks for VirtualBox Guest Additions in registry
Drops file in Drivers directory
Looks for VMWare Tools registry key
Looks for VMWare services registry key.
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Loads dropped DLL
Drops desktop.ini file(s)
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
Drops file in System32 directory
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Discovery
Peripheral Device Discovery
1Query Registry
6System Information Discovery
5System Location Discovery
1System Language Discovery
1Virtualization/Sandbox Evasion
4