General
- Target https://github.com/TheDarkMythos/windows-malware
- Sample241002-2djfxa1amp
Score
10/10
Malware Config
Targets
-
- Target https://github.com/TheDarkMythos/windows-malware
Score10/10Modifies WinLogon for persistence
UAC bypass
Disables RegEdit via registry modification
Disables Task Manager via registry modification
Downloads MZ/PE file
Possible privilege escalation attempt
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Modifies file permissions
Modifies system executable filetype association
Adds Run key to start application
Legitimate hosting services abused for malware hosting/C2
Drops file in System32 directory
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5