General
- Target Extreme Injector.rar
- Size 159.3MB
- Sample260728-ms248sgf94
- SHA256 e6bf0961acb1ed3953df32bcb4e784a65e9114ced8977da61217c1ccbe866ace
Malware Config
Targets
-
- Target Setup.exe
- Size 81.8MB
- SHA256 1d2c79b7fcef16088f804d25b3e074d37e0d1bc7482e0cecec11b939839319b1
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Executes dropped EXE
-
Loads dropped DLL
-
- Target launcher.exe
- Size 73.5MB
- SHA256 2cd5c071482af7c87ad09252f5c1cf2e8dbce52e038cfd28b5c381414545caf8
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
2Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify Tools
2Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Rundll32
1