General
- Target setup_64_rev_101.exe
- Size 75.0MB
- Sample260825-rbc61aaq2w
- SHA256 80cd7a1b246507bb3585c0924790f5c86894c9a94df6f5167db17876702a90f9
Malware Config
Targets
-
- Target setup_64_rev_101.exe
- Size 75.0MB
- SHA256 80cd7a1b246507bb3585c0924790f5c86894c9a94df6f5167db17876702a90f9
Score8/10-
Boot or Logon Autostart Execution: Port Monitors
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Indirect Command Execution
Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Defense Evasion
Indicator Removal
1File Deletion
1Indirect Command Execution
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1