General
- Target 47d57b7dc72f31edd3b52e8c78b7fe0846d7ed8114f8ab98b9a1f5d8e8e89bd2
- Size 8.3MB
- Sample260706-j1j2vaby6w
- SHA256 47d57b7dc72f31edd3b52e8c78b7fe0846d7ed8114f8ab98b9a1f5d8e8e89bd2
Malware Config
Targets
-
- Target 47d57b7dc72f31edd3b52e8c78b7fe0846d7ed8114f8ab98b9a1f5d8e8e89bd2
- Size 8.3MB
- SHA256 47d57b7dc72f31edd3b52e8c78b7fe0846d7ed8114f8ab98b9a1f5d8e8e89bd2
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
2Windows Service
2