General
- Target 7f22451fdb349cf64713c504551fa5d8
- Size 2.1MB
- Sample231222-kvarnaeaar
- SHA256 4eeeb09b82ac8340354fcb7b58f1845adff3d47e4f370e612cb1de7951362aef
Score
10/10
Malware Config
Targets
-
- Target 7f22451fdb349cf64713c504551fa5d8
- Size 2.1MB
- SHA256 4eeeb09b82ac8340354fcb7b58f1845adff3d47e4f370e612cb1de7951362aef
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies WinLogon for persistence
-
UAC bypass
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file
Detects executables packed with VMProtect commercial packer.
-
Legitimate hosting services abused for malware hosting/C2
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1