General
- Target clippy.png
- Size 12KB
- Sample240503-sada2sce86
- SHA256 94108bed7f7a12a203282b5cfd8e1c85127f5888a434d2b8bf2c558ffda032c7
Malware Config
Targets
-
- Target clippy.png
- Size 12KB
- SHA256 94108bed7f7a12a203282b5cfd8e1c85127f5888a434d2b8bf2c558ffda032c7
Score10/10-
Adds autorun key to be loaded by Explorer.exe on startup
-
Modifies firewall policy service
-
Modifies security service
-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
-
Modifies Installed Components in the registry
-
Registers new Print Monitor
-
Sets file execution options in registry
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
Installs/modifies Browser Helper Object
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Browser Extensions
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
6Registry Run Keys / Startup Folder
6Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Change Default File Association
1Defense Evasion
Hide Artifacts
1Resource Forking
1Modify Registry
11Subvert Trust Controls
1SIP and Trust Provider Hijacking
1