General
- Target FadeSEC.exe
- Size 16.7MB
- Sample260818-s8texsvfqa
- SHA256 0844122b393e9f8abdd81296a0d8c891359277185193d238ab9131a0af079570
Malware Config
Targets
-
- Target FadeSEC.exe
- Size 16.7MB
- SHA256 0844122b393e9f8abdd81296a0d8c891359277185193d238ab9131a0af079570
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender Real-time Protection settings
-
Clears Windows event logs
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates VirtualBox registry keys
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Looks for VMWare services registry key.
-
Modifies Windows Firewall
-
Possible privilege escalation attempt
-
Modifies file permissions
-
Stops running service(s)
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
3Indicator Removal
4Clear Windows Event Logs
1File Deletion
3Modify Registry
3Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
2