General
- Target FadeSEC.exe
- Size 712KB
- Sample260808-j9vjyataja
- SHA256 fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90
Malware Config
Targets
-
- Target FadeSEC.exe
- Size 712KB
- SHA256 fc8f693076e884028e26ddb05c921c315e9af9c6fcddede76d4bbb2885419b90
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates VirtualBox registry keys
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Looks for VMWare services registry key.
-
Modifies Windows Firewall
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
3File Deletion
3Modify Registry
3Virtualization/Sandbox Evasion
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1