General
- Target file
- Size 326KB
- Sample260803-3jekksssfv
- SHA256 dd7daad900e26558b88dd243aa8e6ef3fb8413e97963845c3cc64ed2227de003
Score
8/10
Malware Config
Targets
-
- Target file
- Size 326KB
- SHA256 dd7daad900e26558b88dd243aa8e6ef3fb8413e97963845c3cc64ed2227de003
Score8/10-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.
-
System Binary Proxy Execution: Rundll32
Abuse Rundll32 to proxy execution of malicious code.
-
Drops desktop.ini file(s)
-
Hide Artifacts: Hidden Window
Windows that would typically be displayed when an application carries out an operation can be hidden.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Detected potential entity reuse from brand GOOGLE.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Defense Evasion
Hide Artifacts
3File/Path Exclusions
1Hidden Window
1Ignore Process Interrupts
1Impair Defenses
1Disable or Modify Tools
1Obfuscated Files or Information
1Command Obfuscation
1System Binary Proxy Execution
1Rundll32
1