General
- Target 82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f.bin
- Size 5.2MB
- Sample261020-m51ryabb66
- SHA256 82edd622a5d008d3918b663a141a5aa3b0941801d61ff5717c6d52cf67bbdc9f
Score
8/10
Malware Config
Targets
-
- Target EventLog.exe
- Size 398KB
- SHA256 6c204d3433fb2b029a3b3d908b7bfa9e44e14bd66b4bfdb42ba1690079b17f19
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops file in Drivers directory
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
- Target cximagecrtu.dll
- Size 596KB
- SHA256 af5062786294b67d1befa07b6a43e4f22cec72a887fe2e94e937688e15c53cc3
Score3/10 -
- Target libmupdf.dll
- Size 3.3MB
- SHA256 55007f5e02c0be3515177478e9930981c94c59c89043708005c81f5aef84bae5
Score3/10 -
- Target mfc100u.dll
- Size 4.2MB
- SHA256 7a4cfbce1eb48d4f8988212c2e338d7781b9894ef0f525e871c22bb730a74f3e
Score3/10 -
- Target msvcp100.dll
- Size 411KB
- SHA256 a3ba6421991241bea9c8334b62c3088f8f131ab906c3cc52113945d05016a35f
Score3/10 -
- Target msvcr100.dll
- Size 752KB
- SHA256 1221a09484964a6f38af5e34ee292b9afefccb3dc6e55435fd3aaf7c235d9067
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1