General
- Target vs_Community.exe
- Size 4.3MB
- Sample260729-elscfsteqf
- SHA256 d7015300501f843e80862189dbd60b0830b58981e36b4517e5e3c3c1481dd4bf
Malware Config
Targets
-
- Target vs_Community.exe
- Size 4.3MB
- SHA256 d7015300501f843e80862189dbd60b0830b58981e36b4517e5e3c3c1481dd4bf
Score9/10-
Modifies boot configuration data using bcdedit
-
Drops file in Drivers directory
-
Manipulates Digital Signatures
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
-
Possible privilege escalation attempt
-
Boot or Logon Autostart Execution: Print Processors
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
-
Disables service(s)
-
Indicator Removal: Clear Windows Event Logs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Modifies file permissions
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Downloads MZ/PE file
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Drops file in System32 directory
-
Modifies termsrv.dll
Commonly used to allow simultaneous RDP sessions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
1Print Processors
1Create or Modify System Process
2Windows Service
2Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
1Indicator Removal
1Clear Windows Event Logs
1