General
- Target lol1.exe
- Size 2.0MB
- Sample260819-pkgvfafa78
- SHA256 ba113d03b400c41c0aa82764c5f5d1f75980f9ef89b604ee05750bd70f8c4cef
Score
10/10
Malware Config
Targets
-
- Target lol1.exe
- Size 2.0MB
- SHA256 ba113d03b400c41c0aa82764c5f5d1f75980f9ef89b604ee05750bd70f8c4cef
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
- Target $PLUGINSDIR/nsExec.dll
- Size 6KB
- SHA256 8165c7aef7de3d3e0549776535bedc380ad9be7bb85e60ad6436f71528d092af
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1