General
- Target Exploit_Launcher.zip
- Size 77.4MB
- Sample260712-kzss2ahs3t
- SHA256 d24c6372212f010cf3f35fd833413932d98bc28d82d0da3ca228faa8e88e530c
Score
8/10
Malware Config
Targets
-
- Target Exploit_Launcher.exe
- Size 77.7MB
- SHA256 740cc9dbfd08131cb8e2e688acdcad439069716fc325f9d56ff07ffb201f1234
Score8/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information.
-
Drops file in System32 directory
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1