General
- Target https://zoominviteus1.pages.dev/
- Sample260722-wfyeysw1bs
Malware Config
Targets
-
- Target https://zoominviteus1.pages.dev/
Score8/10Downloads MZ/PE file
Modifies Windows Firewall
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Executes dropped EXE
Loads dropped DLL
Stops running service(s)
Adds Run key to start application
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
2Disable or Modify System Firewall
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1