General
- Target cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
- Size 753KB
- Sample260714-xdfb2abt7k
- SHA256 cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
Malware Config
Targets
-
- Target cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
- Size 753KB
- SHA256 cb60c05a179fc2f196486101d1c49be82cb4f6f1771212b02f21b97cfaa0331c
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1