General
- Target Прайс радіостанції.zip
- Size 452KB
- Sample260818-knn1psgn4x
- SHA256 191169db41b1917b8ada44dda809cd75f5226972a1595a899117b1e5fe37c883
Malware Config
Targets
-
- Target Прайс радіостанції.xls
- Size 1010KB
- SHA256 ae7d127c7e1804f6e0777b47d773f80165529d6e2cbbecce0328f5ef952406d5
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Office macro that triggers on suspicious action
Office document macro which triggers in special circumstances - often malicious.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Component Object Model Hijacking
1