General
- Target Debug.zip
- Size 16.0MB
- Sample260726-3tphjaep7y
- SHA256 3d96b2b1bb76b8a35bbf80a29ff001b153bc4d24e5b207e7e74677ec8bbad6f6
Score
10/10
Malware Config
Targets
-
- Target Debug.zip
- Size 16.0MB
- SHA256 3d96b2b1bb76b8a35bbf80a29ff001b153bc4d24e5b207e7e74677ec8bbad6f6
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Modifies visibility of file extensions in Explorer
-
Modifies visibility of hidden/system files in Explorer
-
UAC bypass
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Disables use of System Restore points
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Create or Modify System Process
2Windows Service
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
3Disable or Modify Tools
3Modify Registry
9