General
- Target Matcha_external_v4.2.exe
- Size 4.3MB
- Sample260808-rhlfysyapa
- SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
Malware Config
Targets
-
- Target Matcha_external_v4.2.exe
- Size 4.3MB
- SHA256 86b6b1be6bac42da6c1b74bf514876b849671a7fa82ab0c8251735c43d813644
Score10/10-
Detects Defendnot
-
Family: Defendnot
Defendnot is a tool designed to disable Microsoft Defender.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Indicator Removal: Clear Windows Event Logs
Clear Windows Event Logs to hide the activity of an intrusion.
-
Loads dropped DLL
-
Drops file in System32 directory
-
- Target aforge.dll
- Size 17KB
- SHA256 966a474060a8aca70c73ba09d0b6fe2353035961c7107b9003ef879c010ff8da
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target aforge.video.directshow.dll
- Size 60KB
- SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
Score1/10 -
- Target aforge.video.dll
- Size 20KB
- SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target bouncycastle.crypto.dll
- Size 2.5MB
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target femboy.common.dll
- Size 94KB
- SHA256 dc36e333b9fdb58a9f66c95e777527035f2dd5c7f3cadcf30ab557d004a816aa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target gma.system.mousekeyhook.dll
- Size 56KB
- SHA256 c9736bed57d137a0bd4a454a70436020312db5a365bdd243037e766695c18ccd
Score1/10 -
- Target naudio.core.dll
- Size 183KB
- SHA256 fcf493fc47a2f478a65303886b975fbdbf714cbb1f2d79f7fce97e4bb16b01a8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target naudio.wasapi.dll
- Size 175KB
- SHA256 618ef0e49d64e7a66dfe64bbf6ae81705b9d9683d8a9f321e5c3024d666bdf82
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target naudio.winforms.dll
- Size 40KB
- SHA256 cf92f2f143c22806b88c82f7ec1556f0d814bbd81aca998814709b0da7437f12
Score1/10 -
- Target naudio.winmm.dll
- Size 56KB
- SHA256 749a01ebbb5edd8b1a03c5263b04de6acadecf52e4cc84d7412bc6e93f180958
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target newtonsoft.json.dll
- Size 685KB
- SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
Score1/10 -
- Target protobuf-net.core.dll
- Size 283KB
- SHA256 5012d7cab74e4d5bd9fdd298d05ae5d51442e66d426e5859beb9a513ad1acae4
Score1/10 -
- Target protobuf-net.dll
- Size 271KB
- SHA256 ceed689891874eed41295189b2db3c187aabcfc90add5a1d2af96f078bcb4811
Score1/10 -
- Target sharpdx.d3dcompiler.dll
- Size 57KB
- SHA256 268b44a78354f7a225e5b1567223179c7b73453c0a27eb4bf18bb57d7a8e08d9
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target sharpdx.d3dcompiler.pdb
- Size 21KB
- SHA256 226f82b448c2f8700ca5c9f3658a0808a251f98d8543753e6231bc41b2a2053c
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1