General
- Target Downloads.zip
- Size 93.1MB
- Sample260910-rlvtssdl2s
- SHA256 8eaf1ce6a8193a27939055b987f2e20399aa367defc9a9577a21527a2e15dff3
Malware Config
Targets
-
- Target Downloads.zip
- Size 93.1MB
- SHA256 8eaf1ce6a8193a27939055b987f2e20399aa367defc9a9577a21527a2e15dff3
Score1/10 -
- Target PartitionWizard.exe.mfh
- Size 52B
- SHA256 7f85511fdf70660e7f8d8e0fbd21cb0c7dec661a17fd9464d2ce59c1cf7c1425
Score3/10 -
- Target Setup.exe
- Size 86.6MB
- SHA256 6f0dbd9ec7f01424699254d610f11904f0505ddea787ecb8dbcf09350610a096
Score10/10-
UAC bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Uses browser remote debugging
Can be used to control the browser and steal sensitive information such as credentials and session cookies.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
Hide Artifacts: Hidden Files and Directories
-
- Target partitionwizard.dll
- Size 7.3MB
- SHA256 d4cf22bfad740b51d9abacfaa4138a9a7767c5ea8407ad020098b753b4b5a409
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Modify Authentication Process
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
1Disable or Modify Tools
1Modify Authentication Process
1Modify Registry
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Query Registry
7System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1