General
- Target _3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
- Size 141KB
- Sample260423-tp4bfsaw7s
- SHA256 3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97
Score
10/10
Malware Config
Targets
-
- Target _3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97.exe
- Size 141KB
- SHA256 3f78ac17374f6a96f2b32a8bda63c6d9494ad61be864f0933931637825308e97
Score10/10Modifies Windows Defender DisableAntiSpyware settings
Modifies Windows Defender Real-time Protection settings
Modifies Windows Defender TamperProtection settings
Modifies Windows Defender notification settings
Modifies security service
Possible privilege escalation attempt
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Disables service(s)
Drops startup file
Executes dropped EXE
Modifies file permissions
Adds Run key to start application
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Modifies Security services
Modifies the startup behavior of a security service.
MITRE ATT&CK Enterprise v16
Execution
Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
6Windows Service
6Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
6Windows Service
6Scheduled Task/Job
1Scheduled Task
1