General
- Target 501859cf304469b0c71daae536866f6b8b3a37c4d20a72a72bc21a356712a4e9
- Size 2.8MB
- Sample260820-kmvrvsshne
- SHA256 501859cf304469b0c71daae536866f6b8b3a37c4d20a72a72bc21a356712a4e9
Malware Config
Targets
-
- Target install_v3.1.0.16.exe
- Size 35.0MB
- SHA256 a6ee826cc8864e91dd03e01bc768449f2eba3a9952d4d4ba88776a74e1a01d2e
Score10/10-
UAC bypass
-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Modifies RDP port number used by Windows
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Screensaver
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
5Subvert Trust Controls
2Install Root Certificate
2