General
- Target test.cmd
- Size 617KB
- Sample260704-twbvsadw8j
- SHA256 0df2ddbcd71c806599c24815d07e14de5358494b3b64fb50812ae7e3714ac3d1
Score
8/10
Malware Config
Targets
-
- Target test.cmd
- Size 617KB
- SHA256 0df2ddbcd71c806599c24815d07e14de5358494b3b64fb50812ae7e3714ac3d1
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Executes dropped EXE
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Hide Artifacts: Hidden Files and Directories
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
5File/Path Exclusions
1Hidden Files and Directories
2Hidden Window
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2