General
- Target RegRecov.exe
- Size 44KB
- Sample260809-lk2casvdnh
- SHA256 2a2b343e3b3f8f12f29c1553d9d5f1e9f28dd3626a647c5423d424de68de3298
Malware Config
Targets
-
- Target RegRecov.exe
- Size 44KB
- SHA256 2a2b343e3b3f8f12f29c1553d9d5f1e9f28dd3626a647c5423d424de68de3298
Score10/10-
Modifies WinLogon for persistence
-
Modifies Windows Defender Real-time Protection settings
-
Modifies firewall policy service
-
Modifies security service
-
UAC bypass
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Event Triggered Execution: AppInit DLLs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
-
Event Triggered Execution: Image File Execution Options Injection
-
Modify Registry: Disable Windows Driver Blocklist
Disable Windows Driver Blocklist via Registry.
-
Allows Network login with blank passwords
Allows local user accounts with blank passwords to access device from the network.
-
Boot or Logon Autostart Execution: LSASS Driver
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
-
Modifies system executable filetype association
-
Windows security modification
-
Checks whether UAC is enabled
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Modifies Security services
Modifies the startup behavior of a security service.
-
Modifies WinLogon
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3LSASS Driver
1Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
3AppInit DLLs
1Change Default File Association
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3LSASS Driver
1Winlogon Helper DLL
2Create or Modify System Process
3Windows Service
3Event Triggered Execution
3AppInit DLLs
1Change Default File Association
1Image File Execution Options Injection
1