General
- Target undetek-v10.39.exe
- Size 247KB
- Sample260710-yk2dhsgs2k
- SHA256 2bb2a270e1a9da3e8b2a9e1a857fc67f89f3997f55ff9aa967f8cbe09e97557a
Malware Config
Targets
-
- Target undetek-v10.39.exe
- Size 247KB
- SHA256 2bb2a270e1a9da3e8b2a9e1a857fc67f89f3997f55ff9aa967f8cbe09e97557a
Score10/10-
Modifies Windows Defender notification settings
-
UAC bypass
-
Windows security bypass
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Windows security modification
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
6Subvert Trust Controls
1SIP and Trust Provider Hijacking
1