General
- Target UKVMer.zip
- Size 9.9MB
- Sample250926-e9d5qsdp8x
- SHA256 a50581cd1845d7072037b1f42e30139b6a48cdb0b28edd3368d3bb31a31007bc
Malware Config
Targets
-
- Target Ars8oOPq.exe
- Size 655KB
- SHA256 d983967db817b40b1303f88abde969ebd3d3914c34607c7715992b7aae86d74d
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target UKVMer.exe
- Size 145KB
- SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
Score10/10-
UAC bypass
-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Drops file in Drivers directory
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables service(s)
-
Modifies file permissions
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
- Target XPSPLOG.dll
- Size 4.6MB
- SHA256 8d357b4a4070537b79c8a7c67313b4bc5b4fd8709db6c89a89d7a10d78f8738e
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
2Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
3