General
- Target d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
- Size 12.3MB
- Sample260706-kchdsacv6w
- SHA256 d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
Score
8/10
Malware Config
Targets
-
- Target d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
- Size 12.3MB
- SHA256 d4ecaf00d4fad4bb1caeea2a8998765552b4633dd415d4842a90aef19deaa1ce
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Creates new service(s)
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1