General
- Target New Compressed (zipped) Folder.zip
- Size 13KB
- Sample260722-ygvfsstcpg
- SHA256 9778f5334c454d0f8cd26d7b386de471d4a16f4b49bbb3cffe4b977e65261fa3
Score
10/10
Malware Config
Targets
-
- Target New Compressed (zipped) Folder.zip
- Size 13KB
- SHA256 9778f5334c454d0f8cd26d7b386de471d4a16f4b49bbb3cffe4b977e65261fa3
Score10/10-
Modifies visibility of file extensions in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables use of System Restore points
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
3