General
- Target 4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965
- Size 5.7MB
- Sample260724-ftgrcssfnh
- SHA256 4faaeaa5e7df225e33f8d5e267a5b1e3a262ddf5524b176823901af74d830965
Score
10/10
Malware Config
Targets
-
- Target DingTalkD_Setup.exe
- Size 5.8MB
- SHA256 cb8e4d9dc39ecddc58f6eba2b60ffda80fad7119aad0ea2d7f2501573471ad4f
Score10/10-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1