General
- Target letsview-setup.exe
- Size 2.4MB
- Sample260715-eyd1labv8k
- SHA256 9668ad0def75c0bfccfa01a0a8b4fe3aa24a4f386f0807871edb14b979ac51bf
Malware Config
Targets
-
- Target letsview-setup.exe
- Size 2.4MB
- SHA256 9668ad0def75c0bfccfa01a0a8b4fe3aa24a4f386f0807871edb14b979ac51bf
Score10/10-
Modifies firewall policy service
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Creates new service(s)
-
Modifies file permissions
-
Stops running service(s)
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies Windows Firewall
-
Network Share Discovery
Attempt to gather information on host network.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Impair Defenses
3Disable or Modify System Firewall
2Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1