General

  • Target
    http://www.vatupdate.com/?s=&asp_active=1&p_asid=1&p_asp_data=1&post_date_to=&post_date_to_real=&post_date_from=&post_date_from_real=&termset[category][]=71&filters_initial=1&filters_changed=0&qtranslate_lang=0&current_page_id=-1
  • Sample260702-j7ncvaev5t
Score
7/10

Malware Config

Targets

    • Target
      http://www.vatupdate.com/?s=&asp_active=1&p_asid=1&p_asp_data=1&post_date_to=&post_date_to_real=&post_date_from=&post_date_from_real=&termset[category][]=71&filters_initial=1&filters_changed=0&qtranslate_lang=0&current_page_id=-1
    Score
    7/10
    • A potential corporate email address has been identified in the URL: 6df9e2df42f04e6cf12fb6a4eecd07e4811a9659e292fd725847f6ae03ae468b@group.calendar.google.com

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v16

Tasks