General
- Target 33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5.zip
- Size 120KB
- Sample260925-sdjbgafa38
- SHA256 d7e7f3305e6de323ed5d9f9fe0d129704e035cb611ae70422e427fbd72748b2b
Malware Config
Targets
-
- Target 33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5
- Size 254KB
- SHA256 33e9416c18ee095e92cbb3349f6211fc1a8fb2d066e88c71fec154efb0e938c5
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Modifies system executable filetype association
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Event Triggered Execution
1Change Default File Association
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1