General
- Target zapret-roblox-1.9.8.zip
- Size 2.7MB
- Sample260709-vbnvaaex9t
- SHA256 9506fcdda59532766611e88e3b855324ebfce5f6cfb307c860959ef40ca9a753
Malware Config
Targets
-
- Target bin/winws.exe
- Size 199KB
- SHA256 affb4f69d2ea302a7abccd5325d81826e140ddae014f1e070bc4a6c0dd555188
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT).bat
- Size 3KB
- SHA256 79a97d480379f2a00d11243f54b726c290c574354aad7f3e3689077110c0b1f1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT10).bat
- Size 3KB
- SHA256 38c8e2f17e23c82d90811d8064997f022049580fc17f7fc7d1dcb27541b55e45
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT11).bat
- Size 4KB
- SHA256 aa9f4e22d8308327869adfa4dfb36d7abd1ace9876f9205bb9f52f543520aad4
Score4/10 -
- Target general (ALT2).bat
- Size 3KB
- SHA256 3133f3174bc49c72fa628332d4fab708e9191f6ec55d83aa3a5ecb3fdee42f47
Score4/10 -
- Target general (ALT3).bat
- Size 3KB
- SHA256 3ebb9d6b57aedfeceeeea080cab9d1b5a8657931da2ac95945b0890d9d2f774c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT4).bat
- Size 3KB
- SHA256 dff16df02a590912c43b10ca30eb9c673dec81526cfb117e71d9ac97e860c918
Score4/10 -
- Target general (ALT5).bat
- Size 2KB
- SHA256 61598039abcb5d8cf9ec3c03cc6306e22b3f06ff24814b3e8ad3e9b401bdec7c
Score4/10 -
- Target general (ALT6).bat
- Size 3KB
- SHA256 27dcb6431785c1415df97b08ac1f38c5dc741aea92240c6eb195ec9d23121185
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT7).bat
- Size 3KB
- SHA256 160721780481feee8d4b18d49cc69e1ae5d516e327f87a1b2fed0927fc58847b
Score4/10 -
- Target general (ALT8).bat
- Size 3KB
- SHA256 1e30b5721e5fe949284ebbe8eac1c887ffc08b918082e595b1cfa58ccc9100c2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (ALT9).bat
- Size 3KB
- SHA256 203aa8be1f06d8b78006024d605f34dd78d3e27a09e6f51fbd7e2ec3a65b4f64
Score4/10 -
- Target general (FAKE TLS AUTO ALT).bat
- Size 3KB
- SHA256 1c80042803f64d18ef377895f99b93c4c203227d0023a3efec3b651b1c57b5bf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (FAKE TLS AUTO ALT2).bat
- Size 4KB
- SHA256 af6548d7b53d40492c7d256f60da5469b6414d976da04ed1adf3a4a09792bebf
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (FAKE TLS AUTO ALT3).bat
- Size 4KB
- SHA256 8487fbc1f9c7a47011c7ebc015fd59f999f0d139f2d21ebeda7eea658a73070e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target general (FAKE TLS AUTO).bat
- Size 3KB
- SHA256 91ab60420c3903ca64ca47345393283d0cddcd025f695b3847cc85659a00b918
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1