General
- Target https://gofile.io/d/Tu7jmk
- Sample260726-169m5ascjg
Score
10/10
Malware Config
Targets
-
- Target https://gofile.io/d/Tu7jmk
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops file in System32 directory