General
- Target Qwen_python_20260708_kf1b3ha86.py
- Size 8KB
- Sample260708-2np2faas9n
- SHA256 103fbed2a4251be2765afb28e665c98c7886eca51e4b52357cd96a464ec7961d
Malware Config
Targets
-
- Target Qwen_python_20260708_kf1b3ha86.py
- Size 8KB
- SHA256 103fbed2a4251be2765afb28e665c98c7886eca51e4b52357cd96a464ec7961d
Score10/10-
UAC bypass
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Possible privilege escalation attempt
-
Impair Defenses: Safe Mode Boot
-
Modifies file permissions
-
Adds Run key to start application
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Sets desktop wallpaper using registry
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1