General
- Target c0db880c6452aa0b04b55f216ac78c1ebdf59a4adc14447b0d8bf836f9c8aad4
- Size 15.7MB
- Sample261027-e3kc6sav6x
- SHA256 c0db880c6452aa0b04b55f216ac78c1ebdf59a4adc14447b0d8bf836f9c8aad4
Malware Config
Targets
-
- Target HEVC视频扩展-双击安装.appx
- Size 2.4MB
- SHA256 46695112aa70a05faf71c69ecf4ff0502a3b82d152168d3ffb67219eafe51b85
Score4/10 -
- Target x64/HEVCDECODER_STORE.dll
- Size 1.6MB
- SHA256 b7774bb4e9e87dd010967d4769c1586f2fed7ec398f1b60283ff0bdd59e5c256
Score1/10 -
- Target x64/mfH265Enc.dll
- Size 977KB
- SHA256 9d741aa820995cafe2323c5c9894288ab366f4147d501bbf37f605e5b5bbef2d
Score1/10 -
- Target x86/HEVCDECODER_STORE.dll
- Size 1.3MB
- SHA256 664cfbf8e56b044793b3d33ab2d96eb6502c5dda6b7844a8aee37302e759152a
Score3/10 -
- Target x86/mfH265Enc.dll
- Size 935KB
- SHA256 7a4db55f3040064f24a2d3e3b2e76cc2eaf9676a1648486a3578dc76e8453fee
Score3/10 -
- Target MicrosoftEdgeWebview2Setup.exe
- Size 1.7MB
- SHA256 7ebc4ce80143ef89cea86a61ea151502868db6caaa678b8b43660a66ace11c3a
Score6/10-
Event Triggered Execution: Image File Execution Options Injection
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
- Target ffmpeg.exe
- Size 5.0MB
- SHA256 d03a234a51ccb88127c4c094232dbd7cacc56fd5d4786aa7044dcdeba962545d
Score1/10 -
- Target 红果短剧.exe
- Size 25.2MB
- SHA256 c486c79b3b33c462193fbe706fd96538afa3e229b340a4f18787a92e722ebaa3
Score6/10-
Checks whether UAC is enabled
-
Network Share Discovery
Attempt to gather information on host network.
-
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
1Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2Virtualization/Sandbox Evasion
1System Checks
1Discovery
Network Share Discovery
1Query Registry
6System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Virtualization/Sandbox Evasion
1System Checks
1