General
- Target DCS_World_web.exe
- Size 12.0MB
- Sample260828-23dlysen9w
- SHA256 53617f941f8a889f716ae8185301fc78b74712c6b0aa07f214759422c41fc7a1
Score
8/10
Malware Config
Targets
-
- Target DCS_World_web.exe
- Size 12.0MB
- SHA256 53617f941f8a889f716ae8185301fc78b74712c6b0aa07f214759422c41fc7a1
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Modifies RDP port number used by Windows
-
Suspicious clipboard content.
A suspicious script was copied to clipboard.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1