General
- Target RuDNS_Setup.exe
- Size 4.4MB
- Sample260624-ysnsdsft8q
- SHA256 2d87230488aa115f92997e01939e1fddc8c50e51df48a9d00d38a850b7517ea4
Malware Config
Targets
-
- Target RuDNS_Setup.exe
- Size 4.4MB
- SHA256 2d87230488aa115f92997e01939e1fddc8c50e51df48a9d00d38a850b7517ea4
Score8/10Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Creates new service(s)
Executes dropped EXE
Stops running service(s)
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2