General
- Target execution.dll
- Size 5.0MB
- Sample260722-edmr1aac88
- SHA256 245ca379091992a5f08df8982752b31e8bcc0112bd819d88e00dc272e03c31b7
Score
8/10
Malware Config
Targets
-
- Target execution.dll
- Size 5.0MB
- SHA256 245ca379091992a5f08df8982752b31e8bcc0112bd819d88e00dc272e03c31b7
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Patched UPX-packed file
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s)
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2