General
- Target alzaabitweaksPATCHED.rar
- Size 10.8MB
- Sample260824-p5dnhsde33
- SHA256 dc782f9b27a89270308d5a1c7b80cc9e5f22cd2893370fa6c01ebba5ab0e66cf
Malware Config
Targets
-
- Target alzaabitweaksPATCHED.rar
- Size 10.8MB
- SHA256 dc782f9b27a89270308d5a1c7b80cc9e5f22cd2893370fa6c01ebba5ab0e66cf
Score1/10 -
- Target loader.exe
- Size 12.2MB
- SHA256 c9c6b080c27464ff92c089487b471e25338fe5f4a74d5fbc62e4d6b374c1996e
Score3/10 -
- Target patch/readme.md
- Size 1KB
- SHA256 a04a599b3d10b8d8a681cef932d22f2830c05144aa12461fbf822c9a858cae2c
Score3/10 -
- Target patch/remove.bat
- Size 1KB
- SHA256 1e035ad6c461cce892fce37b1c620aba2adc6fff5edca85e297215761c9bb331
Score8/10-
Drops file in Drivers directory
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target patch/run.bat
- Size 2KB
- SHA256 69ab1b1486f45b2f3cb2e066e6ea325297fe84e0ebe6f6ea10e3abcffec3af35
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Drops file in Drivers directory
-
- Target patch/server.js
- Size 1KB
- SHA256 95fe3d36d3ebab43d45981f6c7ba18a01ffbe715ff6b0c116cf9e1b39ca40bb6
Score3/10 -
- Target حل مشاكل/النسخ.bat
- Size 3KB
- SHA256 02073d1376dfdac0c87c174fc2a54998924d4752b9da126da7ceaabd12b83979
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target حل مشاكل/بلوتوث.bat
- Size 2KB
- SHA256 58735ca27e59fdaf2c89c6712c864c8a5a7aa421eb742531e861ae793a380320
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
- Target حل مشاكل/حل مشكله ابيك قيمز.bat
- Size 2KB
- SHA256 3478c721b327da40bb84eb4f48327477d2be278ec8403fbedaf66f88c6f6e1f3
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target حل مشاكل/حل مشكله الواي فاي والنت.bat
- Size 2KB
- SHA256 ba566e050bb37e329040de4156b1e179ef0ef2534ca4508e31791603cd28c29f
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target حل مشاكل/حل مشكله سطح مكتب.bat
- Size 2KB
- SHA256 0caa0879046feed9dc4bcd54f88995929796fe141621ea6ae8d3aaa3bd1a070c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target حل مشاكل/حل مشكله شاشه CRU.bat
- Size 1KB
- SHA256 799502ee36b7dd851a3843083ba16b4b2f45a45a7684185d0d733a636e734662
Score6/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1