General
- Target Setup.exe
- Size 19.6MB
- Sample260701-mbmcfsbv3n
- SHA256 451590c2017a91e4b0765591659dd7ef882b46e77b6c69cca30d7aa11bf6c42d
Score
9/10
Malware Config
Targets
-
- Target Setup.exe
- Size 19.6MB
- SHA256 451590c2017a91e4b0765591659dd7ef882b46e77b6c69cca30d7aa11bf6c42d
Score9/10-
Looks for VirtualBox Guest Additions in registry
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Looks for VMWare Tools registry key
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext