General
- Target Win11DeathEdition[1].exe
- Size 6.0MB
- Sample260721-knsc5acx2v
- SHA256 bd67e0b196bd3e1b23eb8b6952aefea5cd54dbd48022de958871d8c9678bd56f
Score
8/10
Malware Config
Targets
-
- Target Win11DeathEdition[1].exe
- Size 6.0MB
- SHA256 bd67e0b196bd3e1b23eb8b6952aefea5cd54dbd48022de958871d8c9678bd56f
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Disables Task Manager via registry modification
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
Executes a VBScript file via the Windows Script Host.
Sets desktop wallpaper using registry
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1