Detects WraithNET payload

WraithNET

WraithNET is a trojan written in C++.

Wraithnet family

Looks for VirtualBox Guest Additions in registry

Command and Scripting Interpreter: PowerShell

Run Powershell and hide display window.

Command and Scripting Interpreter: PowerShell

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

Event Triggered Execution: AppInit DLLs

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Event Triggered Execution: Image File Execution Options Injection

Looks for VMWare Tools registry key