General
-
Target
https://www.baixaki.com.br/jogos/rpg/free-fire-pc/windows
-
Sample
240625-rxhcvaycrl
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.baixaki.com.br/jogos/rpg/free-fire-pc/windows
Resource
win11-20240611-en
Malware Config
Targets
-
-
Target
https://www.baixaki.com.br/jogos/rpg/free-fire-pc/windows
-
Creates new service(s)
-
Downloads MZ/PE file
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Possible privilege escalation attempt
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks for any installed AV software in registry
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Subvert Trust Controls
1SIP and Trust Provider Hijacking
1File and Directory Permissions Modification
1Modify Registry
1