General
- Target https://cdn.discordapp.com/attachments/1514297641519808532/1518680262354010173/WormGPT_Windows.zip?ex=6a508d76&is=6a4f3bf6&hm=eeb918d09726cfb1a7f3ec23e6a096aff3edebe12ec16131e2f614398bd9bba7&
- Sample260709-qmpthacs7s
Score
8/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1514297641519808532/1518680262354010173/WormGPT_Windows.zip?ex=6a508d76&is=6a4f3bf6&hm=eeb918d09726cfb1a7f3ec23e6a096aff3edebe12ec16131e2f614398bd9bba7&
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1