General
- Target dControl.exe
- Size 447KB
- Sample260720-tmtn8shv7t
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Malware Config
Targets
-
- Target dControl.exe
- Size 447KB
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Score10/10Modifies Windows Defender DisableAntiSpyware settings
Modifies security service
Windows security bypass
Event Triggered Execution: Image File Execution Options Injection
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Windows security modification
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Indicator Removal: Clear Persistence
remove IFEO.
Modifies Security services
Modifies the startup behavior of a security service.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target out.upx
- Size 653KB
- SHA256 481e03978ca339ce697252895efe89b09fefd3098ad247d24eeb6cca9969f553
Score1/10
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
4Disable or Modify Tools
3Indicator Removal
1Clear Persistence
1Modify Registry
5