General
- Target lol.bat
- Size 232B
- Sample260818-e8gt8sej8z
- SHA256 50246492c76003a44681256ef7f67c1f47422bb10f6bad671ae05e5df9a4974f
Score
10/10
Malware Config
Targets
-
- Target lol.bat
- Size 232B
- SHA256 50246492c76003a44681256ef7f67c1f47422bb10f6bad671ae05e5df9a4974f
Score10/10-
Contains code to disable Windows Defender
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Modifies security service
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Creates new service(s)
-
Executes dropped EXE
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Modifies Security services
Modifies the startup behavior of a security service.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
1Service Execution
1Persistence
Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1