General
- Target HoI4-DLC-Tool.zip
- Size 123.6MB
- Sample260805-azqcssvbke
- SHA256 aa47f5fb44a1d5015cb37add6c7a4b7249081e7e039c2f08dfc366f3f047d88e
Score
8/10
Malware Config
Targets
-
- Target CreamAPI.msi
- Size 19.4MB
- SHA256 fb47fca048699098ecd790a9fa23c732aa5e140bdfdbf3de5be87049cce2989a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Installer Packages
1