General
- Target ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.zip
- Size 798KB
- Sample260803-s567lsbf73
- SHA256 678e71b6e4b28a7d8845f760ff7d21157bb85dd58b3bc72c0bdf8bc7bf25b743
Score
10/10
Malware Config
Targets
-
- Target ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
- Size 1.5MB
- SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Credentials from Password Stores: Windows Credential Manager
Suspicious access to Credentials History.
-
Disables service(s)
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
3Clear Windows Event Logs
1File Deletion
2Modify Registry
2