General
- Target 3ntr_Perm.zip
- Size 17.9MB
- Sample260913-sd7ztsycjf
- SHA256 99bb19f1cc82576df3c8b1cb223c731a67da0b733e6ff36e2ebd59ef1b88e709
Score
10/10
Malware Config
Targets
-
- Target 3ntr_Perm/#2cleaner.exe
- Size 5.8MB
- SHA256 6b4a52f825acb200d074d0d4d464952f505ef215b9d1741424c3bb9dfea748ea
Score8/10Drops file in Drivers directory
Loads dropped DLL
-
- Target 3ntr_Perm/Perm Spoofer.exe
- Size 7.1MB
- SHA256 edb665b5abbcba04ead33e62a5cdf9775f676741aebf212428ad7b51a157eafd
Score10/10Modifies visibility of hidden/system files in Explorer
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
Executes dropped EXE
Adds Run key to start application
Drops file in System32 directory
-
- Target 3ntr_Perm/perm spoofer.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 3ntr_Perm/perm spoofer_v10.exe
- Size 7.0MB
- SHA256 d942aadbefdfc52006302bd893666ba0ec83cdc1e0cbd3e7989f659b9e1da3b3
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4