General
- Target Tools.exe
- Size 11.8MB
- Sample260511-axd7ragx71
- SHA256 49e1216ec23228845567417f4e2814b87bdcc56594c6e8d37f6e1ffb4ac20576
Malware Config
Targets
-
- Target Tools.exe
- Size 11.8MB
- SHA256 49e1216ec23228845567417f4e2814b87bdcc56594c6e8d37f6e1ffb4ac20576
Score10/10-
UAC bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables cmd.exe use via registry modification
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
1File Deletion
1Modify Registry
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
1Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1