General
- Target Open-Historia-Native-Setup.exe
- Size 179.0MB
- Sample261107-rf9e1acv9v
- SHA256 3c86b4ad6fe7974ed4429dc66bd7c327c06427621ae4601176f9490485f1e4ac
Malware Config
Targets
-
- Target Open-Historia-Native-Setup.exe
- Size 179.0MB
- SHA256 3c86b4ad6fe7974ed4429dc66bd7c327c06427621ae4601176f9490485f1e4ac
Score8/10Drops file in Drivers directory
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Network Share Discovery
Attempt to gather information on host network.
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Query Registry
7System Information Discovery
7System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1