General
- Target Minitab.v19.1.x64 Duo_Industrial.rar
- Size 188.2MB
- Sample260701-d3stwadw7n
- SHA256 8e5afd803ef3ad503354b96ebf4e5c6d8abd846e6d20114ac853824d45144e74
Score
6/10
Malware Config
Targets
-
- Target Minitab.v19.1.x64 Duo_Industrial/Crack/Authentication.dll
- Size 5.2MB
- SHA256 6da0180360c1b9945109b2ef92e68e3dae85a16ada78ef1d36aaac478cf7077b
Score1/10 -
- Target Minitab.v19.1.x64 Duo_Industrial/f4-minitab19.1.0.1setup.x64.exe
- Size 198.2MB
- SHA256 f99d8876f77529425f941512543a5b1c02b437e4741d6bcdd02d68a282054337
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1