General
- Target 028c5bc3a6e311aabb7b3ef45d377e68023be5980a9ecf01cd852f3a5a394b41.zip
- Size 24.0MB
- Sample260727-k4n1mszbmd
- SHA256 281883fb269c893d6f9414b5a27edb2d8ef209d5cfade02c3f297fb19a846fb4
Malware Config
Targets
-
- Target 028c5bc3a6e311aabb7b3ef45d377e68023be5980a9ecf01cd852f3a5a394b41.exe
- Size 24.0MB
- SHA256 028c5bc3a6e311aabb7b3ef45d377e68023be5980a9ecf01cd852f3a5a394b41
Score8/10-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Impair Defenses: Safe Mode Boot
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1