General
- Target z.intapp83355008.exe
- Size 77.0MB
- Sample260620-w7kceagx9m
- SHA256 829e13f3fae7cc36ba6b368699b5d4774b4916f2cbf1c79dd1aba8cebd76b587
Malware Config
Targets
-
- Target z.intapp83355008.exe
- Size 77.0MB
- SHA256 829e13f3fae7cc36ba6b368699b5d4774b4916f2cbf1c79dd1aba8cebd76b587
Score10/10UAC bypass
Windows security bypass
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Drops file in Drivers directory
Possible privilege escalation attempt
Disables service(s)
Executes dropped EXE
Loads dropped DLL
Modifies file permissions
Adds Run key to start application
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
Drops file in System32 directory
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
5