General
- Target CustomRP.exe
- Size 1.2MB
- Sample260916-lrkm5aycme
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Score
8/10
Malware Config
Targets
-
- Target CustomRP.exe
- Size 1.2MB
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Score8/10-
Downloads MZ/PE file
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Drops Chrome extension
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
4System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Connections Discovery
1System Time Discovery
1