General
- Target windowsupdate.exe
- Size 27.4MB
- Sample261107-2eb38afy5y
- SHA256 804649056f514308016315e6e8ca0a57e278186d71caaa7bddc8efb384f0a4e9
Score
7/10
Malware Config
Targets
-
- Target windowsupdate.exe
- Size 27.4MB
- SHA256 804649056f514308016315e6e8ca0a57e278186d71caaa7bddc8efb384f0a4e9
Score7/10Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
4System Information Discovery
3System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1System Time Discovery
1