General
- Target GrimClient.zip
- Size 15.2MB
- Sample260708-3g5c8aav2m
- SHA256 cdc399c89b182016d7690a361803a296cb8a8525625aa59a5effceedd9592200
Score
8/10
Malware Config
Targets
-
- Target Grim 1.21.1.temp.jar
- Size 7.9MB
- SHA256 74e15cb4e32e40dfffd1256f1991f934a3a6aa5b3f7930ef9eeaf5cc270e77ad
Score8/10-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
-
Creates new service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target grimloader-1.0-1.temp.jar
- Size 7.4MB
- SHA256 078aaff53208f91cdf4b50ef50b00855fc2a17cd565af2fdf386fea63970660d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2