General

  • Target
    https://api.pastes.dev/pcHNWhQBMw
  • Sample260806-smm11sysat

Malware Config

Targets

    • Target
      https://api.pastes.dev/pcHNWhQBMw
    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Downloads MZ/PE file

    • Registers new Windows logon scripts automatically executed at logon.

MITRE ATT&CK Enterprise v16

Tasks