General
- Target imyfone-anyto_setup-com_anytoen.exe
- Size 2.9MB
- Sample260721-3k2rhagd64
- SHA256 721d9eb9f8c5779147fc1436e80b34ec38eb803469cefa2f5c5be0b610b343df
Malware Config
Targets
-
- Target imyfone-anyto_setup-com_anytoen.exe
- Size 2.9MB
- SHA256 721d9eb9f8c5779147fc1436e80b34ec38eb803469cefa2f5c5be0b610b343df
Score10/10-
Modifies firewall policy service
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies Windows Firewall
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1