General
- Target file
- Size 326KB
- Sample260730-k8psqseh46
- SHA256 e6d69acc60a0565e7d8397d5d103ded2153b223f4749f52b62490f08248ca5b0
Score
8/10
Malware Config
Targets
-
- Target file
- Size 326KB
- SHA256 e6d69acc60a0565e7d8397d5d103ded2153b223f4749f52b62490f08248ca5b0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Command and Scripting Interpreter: PowerShell
Start PowerShell.
-
Drops file in System32 directory
-
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Print Processors
1