General
- Target ainstall-setup63tt0012.zip
- Size 5.8MB
- Sample260702-pezhasgs6j
- SHA256 300ca9fa9416ba2769d1d16dabca2d447a0dce140a1c886e9ea5ae105de6367e
Malware Config
Targets
-
- Target ainstall-setup63tt0012.msi
- Size 6.0MB
- SHA256 0e734a409152912017e21b28bb44e69b16c8a9899f804d4cf4dae1725a383627
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Loads dropped DLL
-
Modifies file permissions
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
File and Directory Permissions Modification
1Indicator Removal
1Clear Persistence
1Modify Registry
2System Binary Proxy Execution
1Msiexec
1