General
- Target OnixPerf.exe
- Size 171KB
- Sample260812-mv3hsavdmc
- SHA256 b9e328c7e5fefac035bdcfc3568fb88a277ca3f2731841ec45272919653c4310
Malware Config
Targets
-
- Target OnixPerf.exe
- Size 171KB
- SHA256 b9e328c7e5fefac035bdcfc3568fb88a277ca3f2731841ec45272919653c4310
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1