General
- Target WarpDeskDesktop-x64-1.0.91-installer.exe
- Size 28.9MB
- Sample261110-e2plhayzav
- SHA256 daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b
Score
9/10
Malware Config
Targets
-
- Target WarpDeskDesktop-x64-1.0.91-installer.exe
- Size 28.9MB
- SHA256 daa6b690a17e1c775a1084b686605a637a864bd943498530de41330c5ec01d9b
Score9/10Enumerates VirtualBox registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Looks for VMWare services registry key.
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
Checks whether UAC is enabled
Network Service Discovery
Attempt to gather information on host's network.
Network Share Discovery
Attempt to gather information on host network.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Discovery
Network Service Discovery
1Network Share Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1System Time Discovery
1Virtualization/Sandbox Evasion
3