General
- Target ADZP 20 Complex.cmd
- Size 22KB
- Sample240724-aea3dazdkf
- SHA256 e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede
Score
8/10
Malware Config
Targets
-
- Target ADZP 20 Complex.cmd
- Size 22KB
- SHA256 e9a085381e930a6c94b749f0ae8326de23db7f6a7bdb3e9dbb3fb36459f87ede
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables Task Manager via registry modification
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Modifies file permissions
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Modifies boot configuration data using bcdedit
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1