General
- Target en_office_professional_plus_2016_x86_x64_dvd_6962141.iso.7z
- Size 1KB
- Sample260916-phr8dsxzdw
- SHA256 72a7fde50fcdcf53b3d00b16644534a70c21435e4a1cb90b3467b536ea384bd9
Malware Config
Targets
-
- Target en_office_professional_plus_2016_x86_x64_dvd_6962141.iso.cmd
- Size 4KB
- SHA256 60b5639b1bb967180d8bcf5c02ee4a500b839c2eccf35005dacc395bee7512d2
Score8/10-
Download via BitsAdmin
-
Event Triggered Execution: Image File Execution Options Injection
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
BITS Jobs
1Browser Extensions
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
BITS Jobs
1Indicator Removal
1Clear Persistence
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1