General
- Target hopeless_v4 (1).exe
- Size 91KB
- Sample260722-xe8pzafl4v
- SHA256 df3c84067f83990234f30c526ec0a891590c7fff293017942c2de610f040f2e0
Score
10/10
Malware Config
Targets
-
- Target hopeless_v4 (1).exe
- Size 91KB
- SHA256 df3c84067f83990234f30c526ec0a891590c7fff293017942c2de610f040f2e0
Score10/10Modifies WinLogon for persistence
Modifies Windows Defender DisableAntiSpyware settings
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Event Triggered Execution: Image File Execution Options Injection
Uses Session Manager for persistence
Creates Session Manager registry key to run executable early in system boot.
Impair Defenses: Safe Mode Boot
Stops running service(s)
Windows security modification
Adds Run key to start application
Modifies WinLogon
Drops file in System32 directory
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
6Disable or Modify Tools
4Safe Mode Boot
1Modify Registry
9