General
- Target Netflix Vm+Sub.exe
- Size 8.3MB
- Sample260624-rtkzkacy51
- SHA256 d0b35b0015fb54b02b23c732a123b9f528b8a22660bb1e25dca4f07f13bdc6ee
Malware Config
Targets
-
- Target Netflix Vm+Sub.exe
- Size 8.3MB
- SHA256 d0b35b0015fb54b02b23c732a123b9f528b8a22660bb1e25dca4f07f13bdc6ee
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Remote Service Session Hijacking: RDP Hijacking
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
-
Modifies RDP port number used by Windows
-
Modifies Windows Firewall
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
3Change Default File Association
1Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Users
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Discovery
Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1System Information Discovery
2System Location Discovery
1System Language Discovery
1