Extracted

• • Target
    https://www.mediafire.com/file/jti1vzkgqwd4cdc/Setup.EXE/file

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Uses WMI to collect hardware manufacturer information

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion
  behavioral1