General
- Target KittytrapV3.exe
- Size 95.7MB
- Sample260802-1qs1faxyfz
- SHA256 8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0
Score
9/10
Malware Config
Targets
-
- Target KittytrapV3.exe
- Size 95.7MB
- SHA256 8531e82a9d4ca8a0f08d678b680695292585ef8fcfd334850601ab1a628a34a0
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Loads dropped DLL
-
Modifies visibility of existing users in the login screen
A user account was hidden or made visible on the Windows login screen through a registry modification.
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
Creates a new local user account
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
-
Sets desktop wallpaper using registry
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Create Account
1Local Account
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1