General
- Target MuMu_5.0.13_PMNDGaC.exe
- Size 5.6MB
- Sample260703-xjd16abs2m
- SHA256 efa0ed24d8b1b90b876315c020d9f82454db9e293e3c3842c639069828180b5a
Score
7/10
Malware Config
Targets
-
- Target MuMu_5.0.13_PMNDGaC.exe
- Size 5.6MB
- SHA256 efa0ed24d8b1b90b876315c020d9f82454db9e293e3c3842c639069828180b5a
Score7/10-
Creates new service(s)
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1