General
- Target RoseNotifier.exe
- Size 14.2MB
- Sample260701-m723sact8k
- SHA256 b78a1f5fb3927a828cf5d03b1f714926c09e7b2c018da2142ce23a6643423922
Malware Config
Targets
-
- Target RoseNotifier.exe
- Size 14.2MB
- SHA256 b78a1f5fb3927a828cf5d03b1f714926c09e7b2c018da2142ce23a6643423922
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Network Share Discovery
Attempt to gather information on host network.
-
Enumerates processes with tasklist
-
- Target default.pyc
- Size 234KB
- SHA256 917662a421f20855046b8baf13cd1db00371df58f4e633944f7a968902ca4beb
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Time Discovery
1