General
- Target watcher-build.zip
- Size 13.6MB
- Sample260909-bef43azfph
- SHA256 9abab408cabcbe31e21ce6bfc43ca2c096bfb78b2878d968f03879e087c12e7a
Malware Config
Targets
-
- Target _internal/PIL/_avif.cp310-win_amd64.pyd
- Size 7.5MB
- SHA256 df0c617422668f1b1b5eece35a0689183942402a16632689d60c3d6488679bc8
Score1/10 -
- Target _internal/PIL/_imaging.cp310-win_amd64.pyd
- Size 2.5MB
- SHA256 16a7c881fd3624c8428078ce24460861e91fc5cc43de1b3614dc2531fe327e2e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/PIL/_imagingcms.cp310-win_amd64.pyd
- Size 267KB
- SHA256 c92c55b43a774b8787a040afdd70c1c086daad5780c73efb35b029c219a03d5f
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/PIL/_imagingmath.cp310-win_amd64.pyd
- Size 21KB
- SHA256 91dbb83922daaa0a601b8a8282be60ebf7633a5b743565c3b579fcafda9b9094
Score1/10 -
- Target _internal/PIL/_imagingtk.cp310-win_amd64.pyd
- Size 14KB
- SHA256 832f6a7f22092fdc7962842170ebadd6ab844dc1f7b4d5582cdf547217ab00be
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/PIL/_webp.cp310-win_amd64.pyd
- Size 406KB
- SHA256 b2b263bd00abe0c1c120efca36f8050c161ce6dbbdb20bf940cc874cae01bac2
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/VCRUNTIME140.dll
- Size 95KB
- SHA256 9d2b40f0395cc5d1b4d5ea17b84970c29971d448c37104676db577586d4ad1b1
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/_bz2.pyd
- Size 81KB
- SHA256 62173a8fadd4bf4dd71ab89ea718754aa31620244372f0c5bbbae102e641a60e
Score1/10 -
- Target _internal/_ctypes.pyd
- Size 120KB
- SHA256 1ea3dd3df393fa9b27bf6595be4ac859064cd8ef9908a12378a6021bba1cb177
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/_decimal.pyd
- Size 248KB
- SHA256 9aac010a424c757c434c460c3c0a6515d7720966ab64bad667539282a17b4133
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/_elementtree.pyd
- Size 125KB
- SHA256 262d771de19a071c2d086717c29dc9a704b33f95f6aa06ec2092f3e8f54495ae
Score1/10 -
- Target _internal/_hashlib.pyd
- Size 63KB
- SHA256 caa4d2f8795e9a55e128409cc016e2cc5c694cb026d7058fc561e4dd131ed1c9
Score1/10 -
- Target _internal/_lzma.pyd
- Size 154KB
- SHA256 60793c8592193cfbd00fd3e5263be4315d650ba4f9e4fda9c45a10642fd998be
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/_queue.pyd
- Size 30KB
- SHA256 925f05255f4aae0997dc4ec94d900fd15950fd840685d5b8aa755427c7422b14
Score1/10 -
- Target _internal/_ssl.pyd
- Size 156KB
- SHA256 d2a7999e234e33828888ad455baa6ab101d90323579abc1095b8c42f0f723b6f
Score6/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target _internal/api-ms-win-core-console-l1-1-0.dll
- Size 21KB
- SHA256 88ace577a9c51061cb7d1a36babbbefa48212fadc838ffde98fdfff60de18386
Score1/10 -
- Target _internal/api-ms-win-core-datetime-l1-1-0.dll
- Size 21KB
- SHA256 1bd81dfd19204b44662510d9054852fb77c9f25c1088d647881c9b976cc16818
Score1/10