General
- Target MultiBlox-v0.0.7-source.zip
- Size 4.1MB
- Sample260819-pawwlstdlb
- SHA256 b67db6eaa3aea1d642e9a85f5ceaf56ae9f12be48ebda85c714221f19378cb6e
Score
8/10
Malware Config
Targets
-
- Target START.bat
- Size 87B
- SHA256 1bec217ca42a91657fb7a9aebb28b26edd6b16af8afd35050df67df20bf96ae4
Score5/10-
Command and Scripting Interpreter: PowerShell
Start PowerShell.
-
- Target handle/handle64.exe
- Size 406KB
- SHA256 24bafcc570cc9bbb6b6e6652a57a519e0464e3996891aaba6f55299cce20b04f
Score8/10-
Drops file in Drivers directory
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target main.py
- Size 425KB
- SHA256 cfec4d5f76b5389cc0eb50150be1467f08b2a386aeefd253a636fcefdd70c197
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1