General
- Target CurseForge Windows - Installer.exe
- Size 2.9MB
- Sample260727-wst83abk6y
- SHA256 30e8ede7638686e020d1346c1f398ecee0218613001ffb0fa03bee2b9edc5cd8
Malware Config
Targets
-
- Target CurseForge Windows - Installer.exe
- Size 2.9MB
- SHA256 30e8ede7638686e020d1346c1f398ecee0218613001ffb0fa03bee2b9edc5cd8
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to get system information as a root user.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Reads ssh keys stored on the system
Tries to access SSH used by SSH programs.
-
Adds Run key to start application
-
Downloads MZ/PE file
-
Network Share Discovery
Attempt to gather information on host network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1