General
- Target Reset_Reregister_Windows_Update_Components_for_Windows11.zip
- Size 1KB
- Sample260720-hec6qsgz3k
- SHA256 90c2e8ce3d1a3c27acb501a1fe611b3ceae5740b0d55c5bfb833c426b3a24756
Score
8/10
Malware Config
Targets
-
- Target Reset_Reregister_Windows_Update_Components_for_Windows11.bat
- Size 5KB
- SHA256 60e3f5280474b860fcf5fd440c58b1e5c9207f565b28772aa39d807598d5f221
Score8/10-
Manipulates Digital Signatures
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Start PowerShell.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
5JavaScript
1PowerShell
2Windows Command Shell
1Persistence
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1