Extracted

• • Target
    Portmaster.exe
  • Size 226KB
  • SHA256 0acec441bd5e924c678d740919a076238ea9674e0a40876fc99f7ba814a8c9fe
  • MD5 dfa00a9673756016084c67c347d982d1
  • SHA1 e474417387df66a3635611b75b28443be117e6b6
  • SHA512 33f55aaf774c986c7bdae08841e80a3f0f26d6c41ee1e9d0ba120807fc20cc5f90295a00cdd8cc35b78622590bbd3529077cb40617e437f6fa7024638af070fb
  • SSDEEP 6144:zxnJ0x3dDeV15Kr3Qnka7To9z6i/4Ij8PLo:zErDm155Ezpj8PLo
  • TLSH
    T190348D00B981C036D566583649B9DF765A2EBCB04F609ACBB3C40EFDCE346D09B39B56
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoveryexecutionlateral_movementpersistenceprivilege_escalation

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Remote Service Session Hijacking: RDP Hijacking

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Disables RegEdit via registry modification

    defense_evasion

  • Disables Task Manager via registry modification

    defense_evasion

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Modifies Windows Firewall

    defense_evasion

  • Disables service(s)

    defense_evasionexecution

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2behavioral3