General
- Target https://cdn.discordapp.com/attachments/1516089294769487984/1517723125859614882/Risxn_Tweaks.exe?ex=6a37514f&is=6a35ffcf&hm=e489374e7a589394ea889ce1e8ef0497ab96ced6a974f6093b6fdefac02e4a12&
- Sample260620-dpm2gacy9l
Score
10/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1516089294769487984/1517723125859614882/Risxn_Tweaks.exe?ex=6a37514f&is=6a35ffcf&hm=e489374e7a589394ea889ce1e8ef0497ab96ced6a974f6093b6fdefac02e4a12&
Score10/10-
UAC bypass
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Stops running service(s)
-
Checks whether UAC is enabled
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
1Modify Registry
2