General
- Target https://github.com/JackDoesMalwares/Gocullinator
- Sample241003-strmsasdlp
Malware Config
Targets
-
- Target https://github.com/JackDoesMalwares/Gocullinator
Score8/10-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Executes dropped EXE
-
Modifies file permissions
-
Legitimate hosting services abused for malware hosting/C2
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Accessibility Features
1Power Settings
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Event Triggered Execution
1Accessibility Features
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Peripheral Device Discovery
1Process Discovery
1Query Registry
3Remote System Discovery
1System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1