General
- Target Fyye_Hub.exe
- Size 12.6MB
- Sample260814-slf63sdp3s
- SHA256 8316e2c60a5396c82bb47f0e9692d7a101f3db7a599bade32e43884f46b6bfa5
Malware Config
Targets
-
- Target Fyye_Hub.exe
- Size 12.6MB
- SHA256 8316e2c60a5396c82bb47f0e9692d7a101f3db7a599bade32e43884f46b6bfa5
Score10/10-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies Windows Firewall
-
Disables service(s)
-
Loads dropped DLL
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
- Target Fyye_Hub.pyc
- Size 23KB
- SHA256 523469cea7721424baed8c838798f0e7803db2d1d26aad45c9d0a849b325858b
Score3/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
3Windows Service
3Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
2File Deletion
2Modify Registry
1