General
- Target BrotinhoGamesOfficialSABFile.rbxl
- Size 20.1MB
- Sample260711-26jmdaa17j
- SHA256 9cc53cf492db636c2a4dfd9ecdeda044f5c0e133d7e9dc196e129eb29c086789
Malware Config
Targets
-
- Target BrotinhoGamesOfficialSABFile.rbxl
- Size 20.1MB
- SHA256 9cc53cf492db636c2a4dfd9ecdeda044f5c0e133d7e9dc196e129eb29c086789
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Network Share Discovery
Attempt to gather information on host network.
-
System Binary Proxy Execution: Verclsid
Adversaries may abuse Verclsid to proxy execution of malicious code.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
4Subvert Trust Controls
1Install Root Certificate
1System Binary Proxy Execution
1Verclsid
1Discovery
Browser Information Discovery
1Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Time Discovery
1