General
- Target ExclusionInstaller.exe
- Size 31.7MB
- Sample260828-s8nvfade87
- SHA256 a10e054dfa58bb5e0547de004d7732470a6bb37f28d9c11fe4a2916875405f4f
Score
8/10
Malware Config
Targets
-
- Target ExclusionInstaller.exe
- Size 31.7MB
- SHA256 a10e054dfa58bb5e0547de004d7732470a6bb37f28d9c11fe4a2916875405f4f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Service Discovery
Attempt to gather information on host's network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Discovery
Network Service Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1