General
- Target Delivery_Unboxing_Verification_Details.zip
- Size 131.8MB
- Sample260731-kljcfaycmh
- SHA256 307594e042248ad7cc9627e8de385851bd92df452216b1b829077d3a93ac815b
Malware Config
Targets
-
- Target Delivery_Unboxing_Verification_Details/uxtheme.dll
- Size 245KB
- SHA256 aee2aefbc73dbf5f65e455ef18e74e158290e21803bf3dd64a05d087bfaceb18
Score10/10-
Detects DonutLoader
-
Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Creates new service(s)
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Browser/xul.dll
- Size 154.7MB
- SHA256 5469b24baff9ae56de2900359e5b1c4c88c189ba1f9d5e42b65acd758c51d95c
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1