General
- Target version-2366ba214ec740ca.zip
- Size 46.3MB
- Sample260930-nhy59s1thy
- SHA256 992986dfc95bee183da2e88b7c5ba3efc0519904d6067a3efcc302ce928bc87d
Score
8/10
Malware Config
Targets
-
- Target public/OPEN ME AS ADMIN.exe
- Size 42KB
- SHA256 2486095b3dd01d4cecd2f0c32b5a4c917a0867f00d6427e20402cc43366ca37c
Score8/10-
Drops file in Drivers directory
-
- Target public/other/Fixes/connectionFix.exe
- Size 21KB
- SHA256 340ecb20720b5f00ede8f9aa46ab82a835d9b41e1ab96cad8e516912db60a5f5
Score8/10-
Modifies Windows Firewall
-
- Target public/other/roblox/Install_Roblox.bat
- Size 951B
- SHA256 7f50550b0e69c22b9342cb0c55d95f8b22378432abd1718f36ee91d1b5be01be
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target public/other/snowfall.cc.exe
- Size 2.7MB
- SHA256 e99dfe9ac51e5608b790afabdca443c278628b46ba8e6908d3ceb81edef011aa
Score5/10-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Debugger Evasion
1Impair Defenses
1Disable or Modify System Firewall
1