General
- Target Optimizer-16.7.exe
- Size 2.5MB
- Sample260802-eqz8vscr91
- SHA256 03a234060541b686ac4265754aff43df9325c21383f90e17f831e67965d717f8
Malware Config
Targets
-
- Target Optimizer-16.7.exe
- Size 2.5MB
- SHA256 03a234060541b686ac4265754aff43df9325c21383f90e17f831e67965d717f8
Score10/10-
Modifies visibility of file extensions in Explorer
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Event Triggered Execution: Image File Execution Options Injection
-
Modifies Windows Firewall
-
Disables service(s)
-
Modifies file permissions
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Power Settings
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Modify Registry
5