General
- Target Full Windows Guide.rar
- Size 4.4MB
- Sample260708-np2jzaf13m
- SHA256 003fc78f50101417ab5bd41aa795bb92f683bffd0971ffc0bcf7d5c0fd91d56b
Malware Config
Targets
-
- Target Full Windows Guide.rar
- Size 4.4MB
- SHA256 003fc78f50101417ab5bd41aa795bb92f683bffd0971ffc0bcf7d5c0fd91d56b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/1. Aesthetic/Chrome.url
- Size 56B
- SHA256 c02747f27631603ec67f08d9d67cf0510d06780178393789caea4a8d17fae422
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/1. Aesthetic/Dark Mode, Transparency Effects + Widgets.bat
- Size 2KB
- SHA256 14156686cee82811edfc1cc4bb1e34972b297863843530ff16e0a809e92b8214
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Possible privilege escalation attempt
-
Disables service(s)
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/1. Aesthetic/risxn wallpaper.png
- Size 32KB
- SHA256 3bb13e87887a87b28626b8ca59cb934e45e3de2fe67321db5544256ddff1681e
Score1/10 -
- Target Full Windows Guide/2. Driver/AMD/AMD Registry Settings.bat
- Size 13KB
- SHA256 78821695db3ab6a5596677f2a3089c2fcb565ac3770b8e9c06042c56cc035dc4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/2. Driver/AMD/Drivers and Support for Processors and Graphics.url
- Size 78B
- SHA256 080abc814f7568ec3059c8afc014f3770ae6de809196c559e7ab8816f50aed14
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/2. Driver/AMD/credit - imribiy.rtf
- Size 7B
- SHA256 0d6afb7e939f0936f40afdc759b5a354ea5427ec250a47e7b904ab1ea800a01d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/2. Driver/NVIDIA/40 series = 572.60.rtf
- Size 7B
- SHA256 0d6afb7e939f0936f40afdc759b5a354ea5427ec250a47e7b904ab1ea800a01d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/2. Driver/NVIDIA/50 series = 580.97.rtf
- Size 7B
- SHA256 0d6afb7e939f0936f40afdc759b5a354ea5427ec250a47e7b904ab1ea800a01d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/2. Driver/NVIDIA/NVCleanstall_1.19.0.exe
- Size 3.8MB
- SHA256 9dd36ef956af927cf41fa441f91b329a7973e13965e4e7d70e6fa9c1df1cade6
Score5/10-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
- Target Full Windows Guide/2. Driver/NVIDIA/Reference.xml
- Size 213KB
- SHA256 5a31c0500500713efd83160cef3db3f56b807b7c4f7a8b4ee7f4ffe05c676081
Score3/10 -
- Target Full Windows Guide/2. Driver/NVIDIA/bestnvcp.nip
- Size 23KB
- SHA256 4438f0915f5d9f225ab137cd9f97fb5ec86de2a6a3389219c9f9b67487e42ec7
Score3/10 -
- Target Full Windows Guide/2. Driver/NVIDIA/nvidiaProfileInspector.exe
- Size 535KB
- SHA256 1233487ea4db928ee062f12b00a6eda01445d001ab55566107234dea4dc65872
Score1/10 -
- Target Full Windows Guide/2. Driver/NVIDIA/nvidiaProfileInspector.exe.config
- Size 158B
- SHA256 383b8dcb968b6bd0633658d9bb55c4acaf4c85a075aa456904a42d4e4efd5561
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Full Windows Guide/3. Debloat/Risxn's Process Panel V4.bat
- Size 40KB
- SHA256 200a9e24e7e9c39c873eff0b7bd15c60490bb02c5ea0860236973c652eb768e3
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target Full Windows Guide/3. Debloat/System Configuration.lnk
- Size 1KB
- SHA256 cbfbf255c5312c6c90e50376cc4efeddab0298d38ff5d5c184e44f737eb96b38
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1