hxxp://infobornware[.]blogspot[.]com/2018/04/ativador-windows-e-office-re-loader[.]html | Triage™

Login
Reports

Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://infobornware....

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

Target
http://infobornware.blogspot.com/2018/04/ativador-windows-e-office-re-loader.html
Sample260730-y2ek3sfa47

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware

Static task

static1

URLScan task

urlscan1

Behavioral task

behavioral1

Sample

http://infobornware.blogspot.com/2018/04/ativador-windows-e-office-re-loader.html

Resource

win10v2004-20260513-en

windows10-2004-x64

34 signatures

900 seconds

defense_evasion discovery execution persistence privilege_escalation ransomware

Malware Config

Targets

- Target
  http://infobornware.blogspot.com/2018/04/ativador-windows-e-office-re-loader.html
Score

8^/10

defense_evasion discovery execution persistence privilege_escalation ransomware
- Downloads MZ/PE file
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Creates new service(s)
  persistence execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Stops running service(s)
  defense_evasion execution
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Image File Execution Options Injection

Netsh Helper DLL

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Image File Execution Options Injection

Netsh Helper DLL

Scheduled Task/Job

Scheduled Task

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Indicator Removal

Clear Persistence

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

urlscan1

behavioral1

defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

© 2018-2026

Terms | Privacy