General
- Target d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
- Size 7.9MB
- Sample260703-mg9pyact8l
- SHA256 d832f9372d91113b183ff0be9cd83e55bc63a87e84756e0f6947e660bd10244a
Score
10/10
Malware Config
Targets
-
- Target shaxiang/UxEnhance64.dll
- Size 3.1MB
- SHA256 abfa2767761a1cb6f10ea40aea491a505f7cb44aa3f91168896b3e5daba7cd86
Score1/10 -
- Target shaxiang/p5ALWJ.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Adds Run key to start application
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1