Extracted

• • Target
    https://cdn.discordapp.com/attachments/1526407467511189574/1531610330373951539/tisleak_xen_2907.zip?ex=6a69d6c6&is=6a688546&hm=6248a36156fe29c8efa3a91b13e7faa5f65b7dbdef0b2be6621e5ec39b703946&

  Score

  10^/10

  defense_evasiondiscoveryexecutiondonutloaderloaderpersistence

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Drops file in System32 directory

  behavioral1