General
- Target SETUP.zip
- Size 27.4MB
- Sample260707-sqlblagx7p
- SHA256 dd9d6ea7ad8db4182dc922a72b5e211b9c8df042c8fa7e7ebd6df0cec08702e9
Malware Config
Targets
-
- Target DLL/ENSF.dll
- Size 408KB
- SHA256 34cd3f4ebb3ccefc530c081e5c836ecd44be1b2bd0f9ec04d86729b8f3f8852a
Score3/10 -
- Target DLL/ENSTRMAPI.dll
- Size 2.6MB
- SHA256 ef4f97e1ba4224abfb7e6e41f14256e2dbb611d25a652dc7031afda73e13ab9c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/ENWLS.exe
- Size 86KB
- SHA256 4110541eb9a4ed5a468cca11909a4e2c4c378c30cdaeac08b8223ef30497f411
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/ES2Diag.dll
- Size 255KB
- SHA256 4a47734a0862564814bcbf1eb1b09f13cd00d01e1a8d0c877aab3061ff667754
Score3/10 -
- Target DLL/E_JTACSV.exe
- Size 257KB
- SHA256 6e4188dd4fd3a5e1ae016bdeafa0f61b7f219acf6965ec5a2d53a8caf52f2b45
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/E_PRLGR7.dll
- Size 100KB
- SHA256 ea650215af1d90d83c4bbfebe814926d8ddb4ffb9797be83b93bef35b2bbabd4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/E_UPWJ01.dll
- Size 988KB
- SHA256 4fef4ff8e72422e355843f0a8dcb82064a88f94ef1c26917f6ccadc31fbd345d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
- Target DLL/E_WTACSV.exe
- Size 286KB
- SHA256 6821f8db3b5a133bd4629df8cecf045b966e0c58731fa31901d6668096075259
Score1/10 -
- Target DLL/FlowSshC64.dll
- Size 7.7MB
- SHA256 1251c20307b08f42dfc4263de905c09868d33aa6cc591c49e9b3b40b4432fa2e
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/FlowSshNet32.dll
- Size 638KB
- SHA256 c5b5c2a51dc7cbe73b439432f66db2692559c947cf5d677fec7cde67202c80b4
Score3/10 -
- Target DLL/FlowSshNet32.msi
- Size 424KB
- SHA256 f65d0fc7e088baf31e289df68096b1e17645043ccb305419af023e1b632a310e
Score7/10-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/FlowSshNet64.dll
- Size 870KB
- SHA256 9ec413230e00e2e2c9f5a2f5a30f456cff687800e59aa5365b2688b6203081f2
Score1/10 -
- Target DLL/FlowSshNet64.msi
- Size 452KB
- SHA256 ba1353d1aad82891a2c248e4c5a83bb622581a7c459da24a3f14858b57318562
Score7/10-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/Innoextract.exe
- Size 1.2MB
- SHA256 946bd06d8b3722a791fea4d84f496139eef6faef61640924cb72f5f1998a68e1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target DLL/MstscTitle.exe
- Size 106KB
- SHA256 a7d9982fb2fd06a0ae0836d7b91177e4fd2bee9b00f38aefb4ef0100adc7da5d
Score1/10 -
- Target DLL/totermc.exe
- Size 3.4MB
- SHA256 6203d02d61d9c76d647aacc133067e7b4a1ebb503a50214e52e23fd23e698ffd
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1