General
- Target iTunes64Setup.zip
- Size 212.0MB
- Sample260805-qaywmsba75
- SHA256 a520db9ed322b1e9cd7dea29072996c3639293eebed2855fe00cd3fdbe7dba40
Score
10/10
Malware Config
Targets
-
- Target iC-BypassTool.exe
- Size 14.8MB
- SHA256 c181f66216e5404f6db4b5862bd8e2a3ff828257f0d74998d4d5c38583cf97ca
Score4/10 -
- Target iTunes64Setup.exe
- Size 200.0MB
- SHA256 290b1049948d08a813392d437161ae4d44f4a7898d13d92c5e98ff02a21d8f7b
Score10/10-
Modifies firewall policy service
-
Adds Run key to start application
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2