General
- Target Release.rar
- Size 18.7MB
- Sample260705-s43g2agy9p
- SHA256 e3ef01e15a94d0a96f20a9a6ff3f1e978e1f52efb64c9a40f325307f79a4b76d
Score
8/10
Malware Config
Targets
-
- Target D3DCompiler_43.dll
- Size 2.4MB
- SHA256 ffedb064adc25328b24dcf145b04045a867a5574c931516d7845babf2a08937f
Score1/10 -
- Target d3dx10_43.dll
- Size 502KB
- SHA256 b5f2e4d842c758fae91323888ace39328c47d9546231757f73831e2369ae58ed
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target d3dx11_43.dll
- Size 273KB
- SHA256 25814402ce1d74f198958aa38661242189b4e5d640177087d0ba0ecf65d19a44
Score1/10 -
- Target d3dx9_43.dll
- Size 2.3MB
- SHA256 36b84dfa0ef9d3ff3549a7ad54d2a8032bd22c879219ee1a959137c4ef8786c4
Score1/10 -
- Target example_win32_directx11.exe
- Size 3.9MB
- SHA256 ab270c5b7da1e402240d0e824b49f74419d0f845c4dec45f92a889cfc6ccfb2b
Score8/10-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1