General
- Target nomorebeasty.rar
- Size 116KB
- Sample260810-1fxwmstybs
- SHA256 074380e0eca6ab929c6cad3e0dfba8bce2b46e55026bb1f539b11eefc1fa0a80
Score
8/10
Malware Config
Targets
-
- Target nomorebeasty.rar
- Size 116KB
- SHA256 074380e0eca6ab929c6cad3e0dfba8bce2b46e55026bb1f539b11eefc1fa0a80
Score8/10-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Sets file to hidden
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
- Target 96/BRO Blocker.exe
- Size 266KB
- SHA256 0ecf8f5bd96d8a3dad5c466f692e76c7583ba85ce2718cc53f487c4a152a2401
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1