General
- Target CustomRP.exe
- Size 1.2MB
- Sample260916-pbct5atz4p
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Malware Config
Targets
-
- Target CustomRP.exe
- Size 1.2MB
- SHA256 912cc56c88a786941a4ba1da25eef70c398a2eb16b7e38a8a5e2b4f33eba7d7d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
6System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Connections Discovery
1System Time Discovery
1