General
- Target 0_DELAY_ULTIMATE_TWEAKS___.bat
- Size 171KB
- Sample260621-ctnywsb18x
- SHA256 dd0639e06253c8c564a96b026e83be08c1242ae084309c5f4115f320a55b36db
Malware Config
Targets
-
- Target 0_DELAY_ULTIMATE_TWEAKS___.bat
- Size 171KB
- SHA256 dd0639e06253c8c564a96b026e83be08c1242ae084309c5f4115f320a55b36db
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender notification settings
-
Modifies security service
-
Modifies visibility of file extensions in Explorer
-
Turns off Windows Defender SpyNet reporting
-
UAC bypass
-
Modifies boot configuration data using bcdedit
-
Event Triggered Execution: Image File Execution Options Injection
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Modifies Security services
Modifies the startup behavior of a security service.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
1Ignore Process Interrupts
1Impair Defenses
6Disable or Modify Tools
5Indicator Removal
2Clear Persistence
1File Deletion
1Modify Registry
8