General
- Target 111.exe
- Size 814KB
- Sample260820-thnmes1arg
- SHA256 74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec
Score
10/10
Malware Config
Targets
-
- Target 111.exe
- Size 814KB
- SHA256 74b4edf01a1ca42a4930be00073961e9e3ca0c5c3527299077bef0b0f5079bec
Score10/10Modifies WinLogon for persistence
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1