General
- Target b2ba880161254c8c2b38a43a0062ac12d7d355243f59df856fd12e53150392fd.bin
- Size 552KB
- Sample260703-mtfydsfw2y
- SHA256 b2ba880161254c8c2b38a43a0062ac12d7d355243f59df856fd12e53150392fd
Malware Config
Targets
-
- Target Technical_Assessment․docx.exe
- Size 94KB
- SHA256 bd86dd6fd89de6759bc50e2d8662162422b777555e82243b8285786f5a46e043
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Adds Run key to start application
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target dxgi.dll
- Size 46KB
- SHA256 07a9923ab00d0b1686eb8ea3c8f49851b4e5ddde30fa16de631ce666acddb3bf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target dxgi2.dll
- Size 46KB
- SHA256 5964e5cc5cf63431c280c54b22ff00ebf0c42d2543461f0ff6ebc922a44fc9e2
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target dxgi_orig.dll
- Size 955KB
- SHA256 3946469c13bb0efa75a2192ce4593caa09eac688923f548b97ef86978799f222
Score1/10 -
- Target office/Technical_Assessment_b.docx
- Size 38KB
- SHA256 c1d53a285ca06a049ba791f9ba5aebc7018b354e6e58f5d46f586161161b22bb
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1