General
- Target d39fad0cdcb1312b02d82eaf1b7a1d754598acfac2953fa0244c0b8ed59418b9
- Size 44.9MB
- Sample260706-kcanyagv8p
- SHA256 d39fad0cdcb1312b02d82eaf1b7a1d754598acfac2953fa0244c0b8ed59418b9
Score
8/10
Malware Config
Targets
-
- Target d39fad0cdcb1312b02d82eaf1b7a1d754598acfac2953fa0244c0b8ed59418b9
- Size 44.9MB
- SHA256 d39fad0cdcb1312b02d82eaf1b7a1d754598acfac2953fa0244c0b8ed59418b9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Registers new Windows logon scripts automatically executed at logon.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1