General
- Target zarar.exe
- Size 11KB
- Sample260824-x88bassfpc
- SHA256 3403a1db583341a117c1ef0002860165409facc354d04d12c10a378a9f5a6376
Malware Config
Targets
-
- Target zarar.exe
- Size 11KB
- SHA256 3403a1db583341a117c1ef0002860165409facc354d04d12c10a378a9f5a6376
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Modifies system executable filetype association
Accesses Microsoft Outlook profiles
Adds Run key to start application
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1