General
- Target FactSet_Workstation_2016_72G_x64.msi
- Size 468.4MB
- Sample260727-x5awmacq31
- SHA256 190c65e6bbf1fc81c2ac9fab5abdae96ddbc6bb8d70da9b68b58ef409f832526
Malware Config
Targets
-
- Target FactSet_Workstation_2016_72G_x64.msi
- Size 468.4MB
- SHA256 190c65e6bbf1fc81c2ac9fab5abdae96ddbc6bb8d70da9b68b58ef409f832526
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Installer Packages
1Defense Evasion
Modify Registry
3Subvert Trust Controls
3Install Root Certificate
2SIP and Trust Provider Hijacking
1System Binary Proxy Execution
1Msiexec
1