General
- Target SmartSign_AggiornamentoDaInternet.exe
- Size 5.3MB
- Sample261030-phpghadv2l
- SHA256 f252adeb6384ef56f9041187e8b0276d7d6bcae5f28e56f6a4144b901a7cd872
Score
8/10
Malware Config
Targets
-
- Target SmartSign_AggiornamentoDaInternet.exe
- Size 5.3MB
- SHA256 f252adeb6384ef56f9041187e8b0276d7d6bcae5f28e56f6a4144b901a7cd872
Score8/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1