General
- Target 51fb7e3ce2fa72aaa4d20bee473de5d7a765f812916f9ba27619f17f39e38e0c
- Size 2.1MB
- Sample261027-jml92sct3q
- SHA256 51fb7e3ce2fa72aaa4d20bee473de5d7a765f812916f9ba27619f17f39e38e0c
Malware Config
Targets
-
- Target procexp.exe
- Size 1.3MB
- SHA256 5db0a6e342a668529f07ad3ed22724f1266c11e8396a046a2d4894a4da820e7d
Score8/10Drops file in Drivers directory
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Hide Artifacts: Hidden Files and Directories
-
- Target procexp64.exe
- Size 2.3MB
- SHA256 b4dc1d3d205736ae7e72cf53f67748d5395a54a19b168e6b073a1b1de736a080
Score8/10Drops file in Drivers directory
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target 去脚本之家看看.url
- Size 124B
- SHA256 c4965fa0cf71f391518797b3cc3b7ffef0ec991c5266f5f9cc90298a7da7e1da
Score1/10 -
- Target 服务器软件.url
- Size 112B
- SHA256 c85359e7af5e102716e42f659fd5c1931b553761898714ccbb261883a03f40e1
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1