General
- Target Defender_Control.exe
- Size 447KB
- Sample260729-g4ycjaee95
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Score
10/10
Malware Config
Targets
-
- Target Defender_Control.exe
- Size 447KB
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies firewall policy service
-
Modifies security service
-
Windows security bypass
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Windows security modification
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Modifies Security services
Modifies the startup behavior of a security service.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
8