Overview

overview

10

Static

static

7

KiPoypXawe...IA.exe

windows11-21h2-x64

8

out.exe

windows11-21h2-x64

3

KiPoypXawe...er.exe

windows11-21h2-x64

5

$PLUGINSDI...er.exe

windows11-21h2-x64

5

KiPoypXawe...ll.bat

windows11-21h2-x64

7

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

7

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

7

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

7

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

7

KiPoypXawe...64.exe

windows11-21h2-x64

7

KiPoypXawe...86.exe

windows11-21h2-x64

7

KiPoypXawe...er.exe

windows11-21h2-x64

10

KiPoypXawe...er.ini

windows11-21h2-x64

3

KiPoypXawe...up.exe

windows11-21h2-x64

7

Resubmissions

01-12-2024 18:15

241201-wwd19axqbx 10

01-12-2024 18:07

241201-wqgj7axpct 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KiPoypXaweM.rar

  • Size

    148.6MB

  • Sample

    241201-wqgj7axpct

  • MD5

    b3503788b45b0d37179147d39219a223

  • SHA1

    e0374d6e75205a8bf60cc73af6a8d403e9dccbc1

  • SHA256

    bf066388ba859d290970a6011de59455dcaa6059b0ca120213b0b601ffe59369

  • SHA512

    c2f51ce89a2390c6c3e6354015e6385678640f68896c7bad41953c16169a28e64d916fb0c81b0482567c1fc0f3324839b8cca5cdec02d2ea107bf5ca220e5eda

  • SSDEEP

    3145728:Vf2l1ouOT92QSfrA6D6CTSmjSRwzWkmwLKkY9UaAv7:VIDW06MXjSR+m1fAv7

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationupx

Malware Config

Targets

    • Target

      KiPoypXaweM/NVIDIA.exe

    • Size

      59.5MB

    • MD5

      e9411904a5793c0accdfe6c04f188f54

    • SHA1

      1685b9afcd93937f56a7f8a34d39bd5e3f2d201b

    • SHA256

      04bc993d4352f2bda8ea5f9d8cf124711b4b5ad82329a64c97fd325f22c6ed98

    • SHA512

      052ac21a92072846107d5785127cb6b47a1cd45b3dc2bf317ade84b6ec6e252d7afd2bf562ef2efe483c4eda632aa808b512cebc3d10b9bcb77a3ff452ed7ef1

    • SSDEEP

      786432:4CAq85qFp3n4/14bJ7spyKbb3vhgnG/GYdXW+nZq4Hw3MutfvvTBlA1l3apTyB5a:zc14t0rGGeH+ZqmwMYNq1l3a4BT6CGO

    Score
    8/10
    evasionexecution

    • Stops running service(s)

      evasionexecution

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

    • Target

      out.upx

    • Size

      653KB

    • MD5

      6970ea0b6597dcd5b4f5f19f28e958a8

    • SHA1

      a0130bb7ac03ec4799c90781ca93fd1392c6d54c

    • SHA256

      481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553

    • SHA512

      bc95cbe9a050e3d3b713745ef399bf2817d38f8e019f6edffdd2bf755badbde766e434e39a7f32356125bba0692b694c18da8dd0762aac0c9430d45acb215e01

    • SSDEEP

      12288:nkxDoouVA2nxKkhEvdRgQriDJOIlW+yBGQowlNCWS:RRmJkioQrilOIc+yMx

    Score
    3/10
    behavioral2

    • Target

      KiPoypXaweM/Requirements/OverwolfInstaller.exe

    • Size

      2.1MB

    • MD5

      66e3c44515e5eddfdd0c05140608bb3d

    • SHA1

      03b432566f443359c195394dd588ca24face2f98

    • SHA256

      257d09cca8254d6ee495fb30c596417574effc54084a8bfee6b5e5e5a957de7c

    • SHA512

      a18f536e1e75700805cdc47d2e73dabb21d17563a1c20b32feee94779795987486eb652c58adf0fa1d875aaba9d5458b5198f299dc4d4195cb04fc089ab0be19

    • SSDEEP

      49152:NnnQYKJxE87vxpsrFpIvFbJo+McPe3ps7DYOcNvxicbs:NntgPN+TIvFby0e5qcOT

    Score
    5/10
    discoverypersistenceprivilege_escalation

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral3

    • Target

      $PLUGINSDIR/OWInstaller.exe

    • Size

      305KB

    • MD5

      4d4b3bc910f70b7bb6d7da07a76c7404

    • SHA1

      082d17c125fb2b7dcb13d1a81dc99fbfc5ecbe75

    • SHA256

      d9274e926fd1202f5691d187a694b130c227eafac03ed59f18e019b881ea8454

    • SHA512

      c54d94a25c23eca98927a14728b62b3b8de41b8ec907d4a3ebcbd63db8ba400537b6fb3e59b243c2f2675eeebe70baa78d75b9a21d4c93a5d43b24d7d386ddc0

    • SSDEEP

      6144:BQXk7Ln7TE5+LoUDxO9bNDoSIm9U0COGq2jppldNcQ0:BQf+bkoS00aut

    Score
    5/10
    persistenceprivilege_escalation

    • Drops file in System32 directory

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation
    behavioral4

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/install_all.bat

    • Size

      1KB

    • MD5

      eb55aae630088c91b88d2bfae4115ea0

    • SHA1

      1495c69946edca474fe30c2b713aacb9f03bbf3a

    • SHA256

      492ee4c16ac45a5483088583c9caa08252d3a1bb3922dbbec834d61673538f17

    • SHA512

      48e4a3fa644b1859131cfec782641aaee9938c88f939ca0509df0f4120b922187753ce7cd7d912d2f90108526ba34d767baa28c9eeeb25d43fff77d38ddfd882

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral5

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x64.exe

    • Size

      3.0MB

    • MD5

      56eaf4e1237c974f6984edc93972c123

    • SHA1

      ee916012783024dac67fc606457377932c826f05

    • SHA256

      0551a61c85b718e1fa015b0c3e3f4c4eea0637055536c00e7969286b4fa663e0

    • SHA512

      f8e15363e34db5b5445c41eea4dd80b2f682642cb8f1046f30ea4fb5f4f51b0b604f7bcb3000a35a7d3ba1d1bcc07df9b25e4533170c65640b2d137c19916736

    • SSDEEP

      49152:+r67+stI6RWGTAdyvlADUrpTmcOgohwJpEM5grO3oc1OXZViFeRyDErkLUMHzkRN:AM9l8pUr9m30L5grOQXZKAsErkbQRN

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral6

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2005_x86.exe

    • Size

      2.6MB

    • MD5

      ce2922f83fb4b170affce0ea448b107b

    • SHA1

      b8fab0bb7f62a24ddfe77b19cd9a1451abd7b847

    • SHA256

      4ee4da0fe62d5fa1b5e80c6e6d88a4a2f8b3b140c35da51053d0d7b72a381d29

    • SHA512

      e94b077e054bd8992374d359f3adc4d1d78d42118d878556715d77182f7d03635850b2b2f06c012ccb7c410e2b3c124cf6508473efe150d3c51a51857ce1c6b0

    • SSDEEP

      49152:rqGRIgg2SirwkF9xdtb43lyGKCafpKkiwnaDahmPzpY4FPyaza:rxxLFfY/KCCpKk9aWMzZyau

    Score
    7/10
    discoverypersistenceprivilege_escalation

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x64.exe

    • Size

      5.0MB

    • MD5

      e2ada570911edaaae7d1b3c979345fce

    • SHA1

      a7c83077b8a28d409e36316d2d7321fa0ccdb7e8

    • SHA256

      b811f2c047a3e828517c234bd4aa4883e1ec591d88fad21289ae68a6915a6665

    • SHA512

      b890d83d36f3681a690828d8926139b4f13f8d2fcd258581542cf2fb7dce5d7e7e477731c9545a54a476ed5c2aaac44ce12d2c3d9b99c2c1c04a5ab4ee20c4b8

    • SSDEEP

      98304:98I8/pCVmdbx2rU/xFnTBU8UeNeagEXtIgvjyGFDdo85qyKYr5NM62dNKViClWPg:9Avx2rw5Th8XeNyGtW0DJr5uDdQdWPet

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral8

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2008_x86.exe

    • Size

      4.3MB

    • MD5

      35da2bf2befd998980a495b6f4f55e60

    • SHA1

      470640aa4bb7db8e69196b5edb0010933569e98d

    • SHA256

      6b3e4c51c6c0e5f68c8a72b497445af3dbf976394cbb62aa23569065c28deeb6

    • SHA512

      bf630667c87b8f10ef85b61f2f379d7ce24124618b999babfec8e2df424eb494b8f1bf0977580810dff5124d4dbdec9539ff53e0dc14625c076fa34dfe44e3f2

    • SSDEEP

      98304:vT4tlQ0aeY51XNURYxaA6qjEb9tRuPmBmWBDLTMTtbslyzRt9cuISY6Qa:vKlhE9U6476itR+mLPw6lyZY61

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral9

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x64.exe

    • Size

      9.8MB

    • MD5

      c9d9eebccef20d637f193490cec05e79

    • SHA1

      15d032d669078aa6f0f7fd1cbf4115a070bd034d

    • SHA256

      cc7ec044218c72a9a15fca2363baed8fc51095ee3b2a7593476771f9eba3d223

    • SHA512

      24b56b5d9b48d75baf53a98e007ace3e7d68fbd5fa55b75ae1a2c08dd466d20b13041f80e84fdb64b825f070843f9247daba681eff16baf99a4b14ea99f5cfd6

    • SSDEEP

      196608:n9A3D5MBD0vwqMKgL29M2JWMWiKV/nPlnqIaAAVINqsAsbPnpCxmz7dU8:23D5MBwZMd0b4oSQ7VSrAs1gEdU8

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral10

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2010_x86.exe

    • Size

      8.6MB

    • MD5

      1801436936e64598bab5b87b37dc7f87

    • SHA1

      28c54491be70c38c97849c3d8cfbfdd0d3c515cb

    • SHA256

      67313b3d1bc86e83091e8de22981f14968f1a7fb12eb7ad467754c40cd94cc3d

    • SHA512

      0b8f20b0f171f49eb49367f1aafa7101e1575ef055d7007197c21ab8fe8d75a966569444449858c31bd147357d2bf5a5bd623fe6c4dbabdc7d16999b3256ab8c

    • SSDEEP

      196608:e9A3DAnfudQZKuNK0kMp2Wxw2tr3aA5Jegn9kaK6Hj0aaNz9ZBJ7C:t3DAnGKZKuNK0SvAn9kaK6gaaNRZbC

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks system information in the registry

      System information is often read in order to detect sandboxing environments.

    behavioral11

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x64.exe

    • Size

      6.9MB

    • MD5

      3c03562b5af9ed347614053d459d7778

    • SHA1

      1a5d93dddbc431ab27b1da711cd3370891542797

    • SHA256

      681be3e5ba9fd3da02c09d7e565adfa078640ed66a0d58583efad2c1e3cc4064

    • SHA512

      6c2f4eeb38705c2dafc4d75d8de0036a0aed197f83e9cb261d255fe26e4391f24b0b156e9019c739dd99057041c2bb80f9ab80f56869bc1e01f0469a76f24f75

    • SSDEEP

      98304:vRWKtOl5CCGomEBkHUBmExJrIUg32t9RRyvo7VnOcyP24Vc35re94tb0eYbY1poo:v3tO3CCT/hBxtVtyUVnmSprzVIY7QKAk

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral12

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2012_x86.exe

    • Size

      6.3MB

    • MD5

      7f52a19ecaf7db3c163dd164be3e592e

    • SHA1

      96b377a27ac5445328cbaae210fc4f0aaa750d3f

    • SHA256

      b924ad8062eaf4e70437c8be50fa612162795ff0839479546ce907ffa8d6e386

    • SHA512

      60220a7c9de72796bd0d6d44e2b82dbdd9c850cc611e505b7dc0213f745ff1f160b2d826eaf62fd6e07c1a31786a71d83dc6e94389690fd59b895e85aba7444b

    • SSDEEP

      196608:OwKjLs+UIkzHlAv4X6zQRgiwHLD2LQIX/:9KjaxFFP1iLD2LnP

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral13

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x64.exe

    • Size

      6.9MB

    • MD5

      49b1164f8e95ec6409ea83cdb352d8da

    • SHA1

      1194e6bf4153fa88f20b2a70ac15bc359ada4ee2

    • SHA256

      a4bba7701e355ae29c403431f871a537897c363e215cafe706615e270984f17c

    • SHA512

      29b65e45ce5233f5ad480673752529026f59a760466a1026bb92fc78d1ccc82396ecb8f07b0e49c9b2315dbef976cb417273c77f4209475036775fe687dd2d60

    • SSDEEP

      196608:bPwMcp4zKAKpCPhD5nsF5GBAiSG5VtJFeHi:0McAWKJsF5vib5VtTeC

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral14

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2013_x86.exe

    • Size

      6.2MB

    • MD5

      38a1b890ce847167d16567cf7b7a5642

    • SHA1

      0f5d66bcaf120f2d3f340e448a268fe4bbf7709d

    • SHA256

      53b605d1100ab0a88b867447bbf9274b5938125024ba01f5105a9e178a3dcdbd

    • SHA512

      907a9aac75f4f241a85ecb94690f74f5818eea0b2241d9ef6d4bf171f17da0f4bc702e2bb90c04f194592fcc61df5c250508d16b886ed837a74b9f45da9627cd

    • SSDEEP

      196608:hPMlUtWUVbuVAwgg1wGiU6QCs9FbEwEhMJ:oUUUNHg1wGd6QxbEwv

    Score
    7/10
    discovery

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral15

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x64.exe

    • Size

      24.2MB

    • MD5

      1d545507009cc4ec7409c1bc6e93b17b

    • SHA1

      84c61fadf8cd38016fb7632969b3ace9e54b763a

    • SHA256

      3642e3f95d50cc193e4b5a0b0ffbf7fe2c08801517758b4c8aeb7105a091208a

    • SHA512

      5935b69f5138ac3fbc33813c74da853269ba079f910936aefa95e230c6092b92f6225bffb594e5dd35ff29bf260e4b35f91adede90fdf5f062030d8666fd0104

    • SSDEEP

      786432:tSp+Ty2SfUfnbDDko5dFMYqlQbgAVLSElbmucMuZZxs6Sf:4p+Ty2SfWnHDk8FjVbfzPTq4

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral16

    • Target

      KiPoypXaweM/Requirements/Visual-C-Runtimes-All-in-One-May-2024/vcredist2015_2017_2019_2022_x86.exe

    • Size

      13.2MB

    • MD5

      8457542fd4be74cb2c3a92b3386ae8e9

    • SHA1

      198722b4f5fc62721910569d9d926dce22730c22

    • SHA256

      a32dd41eaab0c5e1eaa78be3c0bb73b48593de8d97a7510b97de3fd993538600

    • SHA512

      91a6283f774f9e2338b65aa835156854e9e76aed32f821b13cfd070dd6c87e1542ce2d5845beb5e4af1ddb102314bb6e0ad6214d896bb3e387590a01eae0c182

    • SSDEEP

      393216:x3RwlptVYmfr7yBG/4uOzH01/Nc1eJ/RXZMPDyiX:xGpttD7yBG/jx1/N/tZUDJ

    Score
    7/10
    discovery

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral17

    • Target

      KiPoypXaweM/Requirements/Windows Update Blocker/Windows Update Blocker.exe

    • Size

      939KB

    • MD5

      9d6778f7f274f7ecd4e7e875a7268b64

    • SHA1

      452fa439f1cc0b9fcc37cf4b8cfff96e8cc348aa

    • SHA256

      187eeee9e518011de1b87cfb0ed03e12ea551e9011f0c8defdd0e4535e672da2

    • SHA512

      d51df55a5f903ec624550e847459bfa52fb19e892a58fe2de41251d9d98890b36f26a4950ad75f900de0311b5330066aaece11ec5e549d5b3867a61a344e0b87

    • SSDEEP

      24576:12DW/xbqX2YIbzQsu3/PNLIQFHyBvGThpZY9:12EmXGQsW/PN0QNlZI

    Score
    10/10
    evasion
    behavioral18

    • Target

      KiPoypXaweM/Requirements/Windows Update Blocker/Windows Update Blocker.ini

    • Size

      5KB

    • MD5

      911d46b4028427c82c0ce8075dc138de

    • SHA1

      4de65e9f7327e171af891c03aec426b8f30d62a2

    • SHA256

      ddf6c6858f3fefb34d8e64dab9321e041d7aa5e7a1cb5184da1943431f3860d0

    • SHA512

      89a6d2d7563554b9959c7f237a3b9154d1ed6dce097fa90e6e8d900d299055c875e9b72eeb67f9b0149fc33ca9fbc182dfddd7d447090b498562e14c51894e3d

    • SSDEEP

      96:nHYwvIOA8eHJMy8fUyoBdnTsRocVcoByTqKu4YiQiT/rb2J+QzEhW+tI:44IOANJxymdnmDcmy2KuviVPlUEhBm

    Score
    3/10
    behavioral19

    • Target

      KiPoypXaweM/Requirements/dxwebsetup.exe

    • Size

      288KB

    • MD5

      2cbd6ad183914a0c554f0739069e77d7

    • SHA1

      7bf35f2afca666078db35ca95130beb2e3782212

    • SHA256

      2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f

    • SHA512

      ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10

    • SSDEEP

      6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0

    Score
    7/10
    discoverypersistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

2
T1546

Component Object Model Hijacking

1
T1546.015

Installer Packages

1
T1546.016

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

2
T1112

System Binary Proxy Execution

1
T1218

Msiexec

1
T1218.007

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

7
T1012

System Information Discovery

7
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Tasks

static1

upx
Score
7/10

behavioral1

evasionexecution
Score
8/10

behavioral2

Score
3/10

behavioral3

discoverypersistenceprivilege_escalation
Score
5/10

behavioral4

persistenceprivilege_escalation
Score
5/10

behavioral5

discoverypersistenceprivilege_escalation
Score
7/10

behavioral6

discoverypersistenceprivilege_escalation
Score
7/10

behavioral7

discoverypersistenceprivilege_escalation
Score
7/10

behavioral8

discovery
Score
7/10

behavioral9

discovery
Score
7/10

behavioral10

discovery
Score
7/10

behavioral11

discovery
Score
7/10

behavioral12

discovery
Score
7/10

behavioral13

discovery
Score
7/10

behavioral14

discovery
Score
7/10

behavioral15

discovery
Score
7/10

behavioral16

discovery
Score
7/10

behavioral17

discovery
Score
7/10

behavioral18

evasion
Score
10/10

behavioral19

Score
3/10

behavioral20

discoverypersistence
Score
7/10