General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Worm/Fagot.a.exe
-
Sample
230330-t4hy3aeh2y
Score
10/10
Malware Config
Targets
-
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Worm/Fagot.a.exe
Score10/10-
Adds autorun key to be loaded by Explorer.exe on startup
-
Modifies WinLogon for persistence
-
Modifies Windows Defender Real-time Protection settings
-
Modifies firewall policy service
-
Modifies security service
-
Downloads MZ/PE file
-
Modifies Installed Components in the registry
-
Registers new Print Monitor
-
Sets file execution options in registry
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Adds Run key to start application
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Legitimate hosting services abused for malware hosting/C2
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Modifies WinLogon
-
Drops file in System32 directory
-
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Registry Run Keys / Startup Folder
5Winlogon Helper DLL
2Modify Existing Service
3Change Default File Association
1Browser Extensions
1Defense Evasion
Modify Registry
15Disabling Security Tools
1Install Root Certificate
1