General
- Target cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00
- Size 60KB
- Sample260604-z3kddsft9z
- SHA256 cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00
Score
10/10
Malware Config
Targets
-
- Target cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00
- Size 60KB
- SHA256 cb0fbc3588dab06d99ad9c9af872613452ecbb6b7c71b00a6bca4bcc64bb8d00
Score10/10UAC bypass
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1