General
- Target https://cdn.discordapp.com/attachments/1539380628284375060/1539733540189765713/Freerobux.exe?ex=6a895e5a&is=6a880cda&hm=6101814f1c5292d31c4aa76f11887afe6dc342367ac589fb4b8fd2e00daa15f8&
- Sample260821-phebjazdla
Score
10/10
Malware Config
Targets
-
- Target https://cdn.discordapp.com/attachments/1539380628284375060/1539733540189765713/Freerobux.exe?ex=6a895e5a&is=6a880cda&hm=6101814f1c5292d31c4aa76f11887afe6dc342367ac589fb4b8fd2e00daa15f8&
Score10/10Modifies Windows Defender DisableAntiSpyware settings
UAC bypass
Downloads MZ/PE file
Executes dropped EXE
Adds Run key to start application
Checks whether UAC is enabled
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
2Disable or Modify Tools
2Indicator Removal
1Clear Persistence
1Modify Registry
4Subvert Trust Controls
1SIP and Trust Provider Hijacking
1