General
- Target TeraCopy.7z
- Size 3.9MB
- Sample260730-gvx1each29
- SHA256 51b23d7bcb1c0d58239fbb110677628807de83b2d58ad1a6b4f6672c745a4c64
Malware Config
Targets
-
- Target TeraCopy.7z
- Size 3.9MB
- SHA256 51b23d7bcb1c0d58239fbb110677628807de83b2d58ad1a6b4f6672c745a4c64
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target App/DefaultData/PowerOff.cmd
- Size 279B
- SHA256 50c0bc8a1097a40a940133fda83e77d109e1c30fe385e142c646ccfaec9bd4bd
Score3/10 -
- Target App/DefaultData/Pushover.ps1
- Size 626B
- SHA256 3cd8b0cb018775aed7656321749903c4e099a96f793482bc1558f85f1b7a2687
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeraCopy.exe
- Size 6.5MB
- SHA256 26c330f012397f64cbd8cb75c19dd0ce2f18e02cd879cc7baebd84e88b025f55
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target TeraCopy64.dll
- Size 2.0MB
- SHA256 5765c1565c71f4d90a19ba256d191d7a3fb8dee8758e5dc65fb3842acce5f97d
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target TeraCopyExt.dll
- Size 2.0MB
- SHA256 e1da933eab08a98d6624d6fdbbf019cec7c14d12001ac5c72129ab3a3075e726
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
- Target TeraCopyService.exe
- Size 109KB
- SHA256 aa4a9f41f4b05aaaaec2e9dff6474ac01484aaae4c8f3f1c0bd18d7ed538b891
Score1/10 -
- Target share.html
- Size 715B
- SHA256 b309a734a6c4dc05ad32d29ef12d5a477eb61ed465302414b0aec3c8fa317f43
Score3/10 -
- Target sorttable.js
- Size 16KB
- SHA256 72fa6ddc5dfdb54dd35935feaaad9b2a68ca1e872caa4edf03c1a26f1c3e4931
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target unins000.exe
- Size 921KB
- SHA256 0c143ca7c7969ebf7d1c2d177bb90c042873cf9e671b2eb9cbe31c1ccc8c762d
Score7/10-
Deletes itself
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3JavaScript
1PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1