General
- Target https://fleasion.com
- Sample260806-tkl7daer3v
Malware Config
Targets
-
- Target https://fleasion.com
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
Drops file in Drivers directory
ACProtect 1.3x - 1.4x DLL software
Detects file using ACProtect software.
Executes dropped EXE
Loads dropped DLL
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1