General
- Target qwley-shade-launcher (1).exe
- Size 11.9MB
- Sample261107-nlek2axybw
- SHA256 e7fa1cf72e5ae1ef7f7ed18e099d28ac2dbce8ed2cafa5c57206d1978a608115
Score
8/10
Malware Config
Targets
-
- Target qwley-shade-launcher (1).exe
- Size 11.9MB
- SHA256 e7fa1cf72e5ae1ef7f7ed18e099d28ac2dbce8ed2cafa5c57206d1978a608115
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Network Share Discovery
Attempt to gather information on host network.
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Defense Evasion
Debugger Evasion
1Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
2