General
- Target 1d607dd9f38c4a03e95ffbfa68f2df79645b243be474bcb73e1f0a58c0971a9a
- Size 875KB
- Sample260826-e23hcsgm2t
- SHA256 1d607dd9f38c4a03e95ffbfa68f2df79645b243be474bcb73e1f0a58c0971a9a
Score
10/10
Malware Config
Targets
-
- Target Order_Specification_Company_profile_PDF.exe
- Size 1.1MB
- SHA256 00685825a428311f30343266b8ea641ef868c5bd91e3ccca464c5ad46f1d27d5
Score10/10-
Modifies WinLogon for persistence
-
.NET Reactor proctector
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1