af65072fd228a47cc3e8a8d1461688c1b53c2ec91949b472decba4d97289253b | Triage

Sharing

General

Target

taskbroker.vbs
Size

3KB
Sample

250330-zwvksayrx9
MD5

ec056bdc0223f3f5df9ae591cba9b24c
SHA1

0f1688d29ef4d471664e5091b378250b3bea2805
SHA256

af65072fd228a47cc3e8a8d1461688c1b53c2ec91949b472decba4d97289253b
SHA512

2e0ae2af69b93cd6dd27aab7d8a04f02db6b2dc7a47d50e1ee9e91cd5461733bb8176dd0ed696ecb77a7514541db7449eacf43d07a933c8c8e0c82897eff0ac4

Score

10^/10

defense_evasion evasion execution trojan

Malware Config

Targets

- Target
  
  taskbroker.vbs
- Size
  
  3KB
- MD5
  
  ec056bdc0223f3f5df9ae591cba9b24c
- SHA1
  
  0f1688d29ef4d471664e5091b378250b3bea2805
- SHA256
  
  af65072fd228a47cc3e8a8d1461688c1b53c2ec91949b472decba4d97289253b
- SHA512
  
  2e0ae2af69b93cd6dd27aab7d8a04f02db6b2dc7a47d50e1ee9e91cd5461733bb8176dd0ed696ecb77a7514541db7449eacf43d07a933c8c8e0c82897eff0ac4
Score

10^/10

defense_evasion evasion execution trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Checks whether UAC is enabled
  defense_evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Create or Modify System Process

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionevasionexecutiontrojan

behavioral2

defense_evasionevasionexecutiontrojan