General
- Target EmberveilLauncherSetup.7z
- Size 10.8MB
- Sample260815-xqabjsfp3w
- SHA256 8d38dd6ae5e97e98555b5f4a8138e3612ae4f2e7d46f3ca687ebc3415648224e
Score
8/10
Malware Config
Targets
-
- Target EmberveilLauncherSetup.exe
- Size 11.3MB
- SHA256 d910f5beb7521fba262cee486f2d00fc38c56be70a918d811a56c18e952f888c
Score8/10-
Installs a root certificate to the trusted certificate store
A root certificate was added to the trusted certificate store using CertUtil.
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
MITRE ATT&CK Enterprise v16
Defense Evasion
Subvert Trust Controls
2Install Root Certificate
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
5System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1