General
- Target e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
- Size 2.0MB
- Sample260806-m9pkgazanf
- SHA256 e4d1d38fa48e3486fc0964ee9101bfb1f032297db2078d01a891f2a2bab3943a
Score
8/10
Malware Config
Targets
-
- Target Snapshot/#清理卸载.bat
- Size 4KB
- SHA256 ff958df6dc1058e27c4f410b8a3d5a1e07133dcdca18fb5cc7812eaa50bdc8a7
Score8/10-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
-
Stops running service(s)
-
- Target Snapshot/31_BCD引导编辑.cmd
- Size 74B
- SHA256 7e6ab2449af4b04e98fcfee0d54d5ac128ce940b1d268e06a3b8a1340a73f4f4
Score3/10 -
- Target Snapshot/32_NT6+ 引导修复.cmd
- Size 76B
- SHA256 a0ec330ad54f149da2438062ae9a3bc3310b9311c9a78a4bf4796995b02a1173
Score3/10 -
- Target Snapshot/Snapshot64.exe
- Size 1.5MB
- SHA256 ef5bf3f8c8a2bc6f09e01b441bf3628a29525a0727343cad480b784fb594c124
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target Snapshot/Snapshot备份还原.exe
- Size 530KB
- SHA256 5ef67d9fa3d61e35f6ced2bf996ef8d3b65dc430cb5e4f3bb1f46f86a10b0ac9
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Snapshot/SysVer.cmd
- Size 4KB
- SHA256 1c9b1b914176ef36bcc84eb80cf260c0f2490e644ce081f2d5e4d134313eb28e
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Modify Registry
1