General
- Target SpoolerDR800.zip
- Size 754KB
- Sample260722-ph1vja1vfv
- SHA256 6a65494b4c5fa399dedbae32a017f8a273a7485119306b8bb31f18301cc836bc
Score
8/10
Malware Config
Targets
-
- Target Driver_Spooler_800.exe
- Size 833KB
- SHA256 1165fe49fd34c94fca454fd22f71b4d82bc58f4ee7ac52b57115380424381d07
Score8/10-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1