General
- Target f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937
- Size 308KB
- Sample260723-xsbmdshr9t
- SHA256 f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937
Score
10/10
Malware Config
Targets
-
- Target f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937
- Size 308KB
- SHA256 f170f0cd3d51ef0d2448c8fedb48e11a723d4489902fbd950557ec619354e937
Score10/10-
Modifies Windows Defender Real-time Protection settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies Windows Defender notification settings
-
Modifies firewall policy service
-
Windows security bypass
-
Boot or Logon Autostart Execution: LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
-
Executes dropped EXE
-
Windows security modification
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4Privilege Escalation
Boot or Logon Autostart Execution
1LSASS Driver
1Create or Modify System Process
4Windows Service
4