General
- Target VMAudioBackHost_1.0.0.zip
- Size 83KB
- Sample260820-1swt4szshs
- SHA256 282343729eec9ef7808e373793daabbba780776d48f791b571c8fd2e64cc3e7c
Malware Config
Targets
-
- Target VMAudioBackHost_1.0.0.zip
- Size 83KB
- SHA256 282343729eec9ef7808e373793daabbba780776d48f791b571c8fd2e64cc3e7c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target LICENSE
- Size 34KB
- SHA256 3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986
Score3/10 -
- Target README.txt
- Size 480B
- SHA256 af083da68057151dee60f99c37d03a532df89c4eb01920113d57dfd18a0b2c10
Score1/10 -
- Target VMAudioBackHost.dll
- Size 116KB
- SHA256 45c329dede0d033c1b42c5057a583d82c0e087dec649fffd0272b6d1e1d09768
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target VMAudioBackHost.exe
- Size 45KB
- SHA256 e93e27fa9c36cffd7fafb98933f8789d2798c57b7768a61ac56abac98f363283
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Pre-OS Boot
1Bootkit
1Defense Evasion
Modify Registry
2Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1