Executive Overview — What We’re Dealing With

This specimen has persisted long enough to matter. Human experts classified it as Malware, and the telemetry confirms a capable, evasive Trojan with real impact potential.

Extended Dwell Time Impact

For 23+ hours, this malware remained undetected — a half-day window that permitted the adversary to complete initial execution, establish basic persistence, and perform initial system enumeration.

Global Detection Posture — Who Caught It, Who Missed It

VirusTotal engines: 73. Detected as malicious: 59. Missed: 14. Coverage: 80.8%.

Why it matters: if any endpoint relies solely on a missed engine, this malware can operate with zero alerts. Prevention‑first controls close that gap regardless of signature lag.

Behavioral Storyline — How the Malware Operates

Intensive file system activity (57.52% of behavior) indicates data harvesting, file encryption, or dropper behavior. The threat is actively searching for and manipulating files across the system.

MITRE ATT&CK Mapping

• T1129 – link function at runtime on Windows
• T1112 – delete registry key
• T1059 – accept command line arguments
• T1012 – query or enumerate registry value
• T1082 – query environment variable
• T1027 – reference Base64 string
• T1129 – Drops a binary and executes it
• T1053 – Installs itself for autorun at Windows startup
• T1564 – A process created a hidden window
• T1202 – Uses Windows utilities for basic functionality
• T1562 – Attempts to stop active services
• T1562 – Tries to unhook or modify Windows functions monitored by CAPE
• T1036 – Attempts to make a network connection via suspicious process
• T1055 – Attempts to make a network connection via suspicious process
• T1112 – Installs itself for autorun at Windows startup
• T1112 – Installs itself for autorun at Windows startup
• T1070 – Clears Windows events or logs
• T1070 – Deletes executed files from disk
• T1562.001 – Attempts to stop active services
• T1562.001 – Tries to unhook or modify Windows functions monitored by CAPE
• T1027 – The binary likely contains encrypted or compressed data
• T1564.003 – A process created a hidden window
• T1027.002 – The binary likely contains encrypted or compressed data
• T1543 – Attempts to stop active services
• T1543 – Created a service that was not started
• T1547 – Installs itself for autorun at Windows startup
• T1543.003 – Attempts to stop active services
• T1543.003 – Created a service that was not started
• T1547.001 – Installs itself for autorun at Windows startup
• T1489 – Attempts to stop active services
• T1486 – Exhibits possible ransomware or wiper file modification behavior: overwrites_existing_files
• T1485 – Anomalous file deletion behavior detected (10+)
• T1485 – Clears Windows events or logs
• T1082 – Checks available memory
• T1082 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1057 – Expresses interest in specific running processes
• T1057 – Enumerates running processes
• T1012 – Access the NetLogon registry key, potentially used for discovery or tampering
• T1071 – Attempts to connect to a dead IP:Port
• T1071 – The PE file contains a PDB path
• T1071 – HTTP traffic contains suspicious features which may be indicative of malware related traffic
• T1071 – Likely virus infection of existing binary
• T1071 – Dynamic (imported) function loading detected
• T1071 – Reads data out of its own binary image
• T1071 – Resolves a suspicious Top Level Domain (TLD)
• T1071 – A process attempted to delay the analysis task.
• T1547.008 – Spawns drivers
• T1547.008 – Enables driver privileges
• T1548 – Found direct / indirect Syscall (likely to bypass EDR)
• T1036 – Drops executable to common a third party application directory
• T1036 – Drops PE files to the windows directory (C:\\Windows)
• T1036 – Creates a directory in C:\Program Files
• T1036 – Creates files inside the program directory
• T1036 – Creates files inside the system directory
• T1036 – Creates files inside the user directory
• T1497 – May sleep (evasive loops) to hinder dynamic analysis
• T1027 – Binary may include packed or crypted data
• T1027.002 – Binary may include packed or crypted data
• T1070.006 – Binary contains a suspicious time stamp
• T1082 – Queries the volume information (name, serial number etc) of a device
• T1082 – Checks if Microsoft Office is installed
• T1082 – Queries the cryptographic machine GUID
• T1080 – Infects executable files (exe, dll, sys, html)
• T1105 – Downloads files from webservers via HTTP
• T1105 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1105 – Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.
• T1095 – Downloads files from webservers via HTTP
• T1095 – Posts data to webserver
• T1095 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1071 – Downloads files from webservers via HTTP
• T1071 – Posts data to webserver
• T1071 – Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)
• T1071 – Uses a known web browser user agent for HTTP communication

Following the Trail — Network & DNS Activity

Outbound activity leans on reputable infrastructure (e.g., CDNs, cloud endpoints) to blend in. TLS sessions and
HTTP calls show routine beaconing and IP‑lookup behavior that can masquerade as normal browsing.

Hunting tip: alert on unknown binaries initiating TLS to IP‑lookup services or unusual CDN endpoints — especially early in execution.