General
- Target 250125-wzc85awrbq_pw_infected.zip
- Size 15.0MB
- Sample260625-shcpgscx6s
- SHA256 183bcc880e548877719b2e3869788c53ca2432bf348b788ea50446074dd5cfc9
Score
10/10
Malware Config
Targets
-
- Target Mandela.exe
- Size 15.2MB
- SHA256 c6818da28a36a7ed628e5a86ede3a642b609b34b2f61ae4dba9a4814d6822d2f
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Checks whether UAC is enabled
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create or Modify System Process
1Windows Service
1