General
- Target f22c57c2694ebfc1cc1287301a09f2269171a62fb7f19f11ba7c2485b119986e
- Size 88KB
- Sample241102-vvarrstkcr
- SHA256 f22c57c2694ebfc1cc1287301a09f2269171a62fb7f19f11ba7c2485b119986e
Score
10/10
Malware Config
Targets
-
- Target f22c57c2694ebfc1cc1287301a09f2269171a62fb7f19f11ba7c2485b119986e
- Size 88KB
- SHA256 f22c57c2694ebfc1cc1287301a09f2269171a62fb7f19f11ba7c2485b119986e
Score10/10-
Windows security bypass
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Event Triggered Execution: Image File Execution Options Injection
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Modifies WinLogon
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Winlogon Helper DLL
1Event Triggered Execution
1Image File Execution Options Injection
1