General
- Target 8770715e04d7b3cd684d96a42bc52861447581e7b44513d476e7705550108bcd
- Size 3.5MB
- Sample260702-vm2khsav4t
- SHA256 8770715e04d7b3cd684d96a42bc52861447581e7b44513d476e7705550108bcd
Malware Config
Targets
-
- Target 8770715e04d7b3cd684d96a42bc52861447581e7b44513d476e7705550108bcd
- Size 3.5MB
- SHA256 8770715e04d7b3cd684d96a42bc52861447581e7b44513d476e7705550108bcd
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ComIntRep v11.1.3/ComIntRep.exe
- Size 2.1MB
- SHA256 7d2590bbe18a10c329b7558e5f862d27867596493104d69796067b4e755d22fd
Score5/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target ComIntRep v11.1.3/ComIntRep_X64.exe
- Size 2.2MB
- SHA256 de4f40cf15b6b8af2efd8905b3fd82180b108d67ab87d4e51bbbab528e253680
Score8/10-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target ComIntRep v11.1.3/Source/Includes/About.au3
- Size 15KB
- SHA256 fbd671a9c75ab40b21f95296b877ca0df6685526c7c5a16c2ec58cd093dfaeaa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ComIntRep v11.1.3/Source/Includes/AutoIt3Script.au3
- Size 7KB
- SHA256 9e3da3de63468e6380f34cb610cd41ab6e10f22031500a8fc1312445fe28fc53
Score3/10 -
- Target ComIntRep v11.1.3/Source/Includes/FileEx.au3
- Size 8KB
- SHA256 71a3f68207ef3a7e56a414919f1aeb544d7b674e1acc4f5c1df06e3196b4de5f
Score3/10 -
- Target ComIntRep v11.1.3/Source/Includes/GuiMenuEx.au3
- Size 44KB
- SHA256 5605b1e757522f2927c62f4435188c2174a57d89b9222ea7e0dd0bf96ff4ddaf
Score3/10 -
- Target ComIntRep v11.1.3/Source/Includes/Icons.au3
- Size 32KB
- SHA256 a08e097e9e39e824e6b1c20d4d79649a7b1414ceefcebf1fbf56c12a924dcc22
Score3/10 -
- Target ComIntRep v11.1.3/Source/Includes/Update.au3
- Size 9KB
- SHA256 bbb0ab200385456c9048f06f7d7512d608851a17995577e78937e51f5df7aaa2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target ComIntRep v11.1.3/Source/Includes/Versioning.au3
- Size 8KB
- SHA256 1a22aafc908c576b032d4f4f46efa464b721caa05bbc9f92b53e1c5579eb5901
Score3/10 -
- Target ComIntRep v11.1.3/系统迷xitmi.com.url
- Size 112B
- SHA256 6d3813a3a39b6098b541e971f54c90b2c2c63132ac197596e1e37b8929b0a7eb
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1