General
- Target fish.mcpr
- Size 9.7MB
- Sample260801-s9fkfssvdt
- SHA256 b6986ee713173eeb5dc4bf52f8e9f1839182471fec8c44500e9538a62c50cd3b
Score
10/10
Malware Config
Targets
-
- Target fish.mcpr
- Size 9.7MB
- SHA256 b6986ee713173eeb5dc4bf52f8e9f1839182471fec8c44500e9538a62c50cd3b
Score10/10-
Modifies WinLogon for persistence
-
UAC bypass
-
Disables RegEdit via registry modification
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks whether UAC is enabled
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Drops desktop.ini file(s)
-
Modifies WinLogon
-
Sets desktop wallpaper using registry
-
- Target markers.json
- Size 123B
- SHA256 dbc435eddb6b7c9eb3a14e245868b599d9e23c70c95c07e2a2f2a9d97b757f0e
Score3/10 -
- Target metaData.json
- Size 23KB
- SHA256 ca10b54a8e4d1254252d8d33d0a6c81cb15480d96f82f221d999fa6910743382
Score3/10 -
- Target mods.json
- Size 105B
- SHA256 cb3161c33538c1666b79ea5a20b9c6a188a02e349e20e5bc23a1abe2665f2578
Score3/10 -
- Target recording.tmcpr
- Size 122.1MB
- SHA256 f9e20394caae200bae5e03e8877fb62b1fb753420db7cf8d49465cf7e9161018
Score3/10 -
- Target recording.tmcpr.crc32
- Size 10B
- SHA256 1c3ecc696ce0c09cfc4682fe014793bb7819d460bc52f3f042b3cddd957538a1
Score3/10
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Winlogon Helper DLL
2Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
5