General
- Target boykisser.exe
- Size 1.6MB
- Sample260628-y9142sdw6v
- SHA256 547c930de802429f6bafc456bbd4ad5e39df8f5a736fd664ecd0612c5c5c1480
Score
10/10
Malware Config
Targets
-
- Target boykisser.exe
- Size 1.6MB
- SHA256 547c930de802429f6bafc456bbd4ad5e39df8f5a736fd664ecd0612c5c5c1480
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies Windows Firewall
-
Disables service(s)
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
2Obfuscated Files or Information
1Command Obfuscation
1