General

  • Target
    https://ken_kong_connect_docusign_com-dot-mmemails4.appspot.com/em_2mT4tQegi3sIvmKL4TUL?url=https%3A%2F%2Fclick.docusign.com%2Fc%2Fken-kongdocusign-com&key=9e8d22bd4380cefc278f42b638b51aba86b0abf9
  • Sample260717-cfkdjsc131

Malware Config

Targets

    • Target
      https://ken_kong_connect_docusign_com-dot-mmemails4.appspot.com/em_2mT4tQegi3sIvmKL4TUL?url=https%3A%2F%2Fclick.docusign.com%2Fc%2Fken-kongdocusign-com&key=9e8d22bd4380cefc278f42b638b51aba86b0abf9
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • A potential corporate email address has been identified in the URL: 758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v16

Tasks