General
- Target Aganiga3213.exe
- Size 16.3MB
- Sample261003-trzfaascqd
- SHA256 8fe5e656f76f172c0cfb213897116d85bd1573f8057838f87a7d1b5926e4e283
Malware Config
Targets
-
- Target Aganiga3213.exe
- Size 16.3MB
- SHA256 8fe5e656f76f172c0cfb213897116d85bd1573f8057838f87a7d1b5926e4e283
Score9/10-
Looks for VirtualBox drivers on disk
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Looks for VMWare drivers on disk
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Loads dropped DLL
-
Checks for any installed AV software in registry
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Discovery
File and Directory Discovery
2Peripheral Device Discovery
1Process Discovery
1Query Registry
2Software Discovery
1Security Software Discovery
1System Information Discovery
3System Network Configuration Discovery
3Internet Connection Discovery
1Wi-Fi Discovery
1Virtualization/Sandbox Evasion
2