General
- Target 20102026_0553_20102026_Acrobat_Reader-install.V9.2.bat.gz
- Size 624B
- Sample261020-glc9msdv8x
- SHA256 3fef2f29c2ae64b7909b7a1c543af3d87c56c073a5870eb346089a47a0960a17
Malware Config
Targets
-
- Target Acrobat_Reader-install.V9.2.bat
- Size 1KB
- SHA256 8b37ad64c835fd185571c6e55917e821162edb172a43549b5cb2a4044133a1d2
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
GoToResolve remote administration tool
GoToResolve is a remote administration tool that can be used as a backdoor
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Checks system information in the registry
System information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1