General
- Target 0f3e18d8ead579019815a1bf270eb92464120354d274e78959ea829964905eb2
- Size 7.7MB
- Sample260823-j2mt5avcjh
- SHA256 0f3e18d8ead579019815a1bf270eb92464120354d274e78959ea829964905eb2
Score
10/10
Malware Config
Targets
-
- Target KQoX40/7xqNdX.exe
- Size 135KB
- SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
Score10/10-
Windows security bypass
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Adds Run key to start application
-
Indicator Removal: Clear Persistence
Clear artifacts associated with previously established persistence like scheduletasks on a host.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops file in System32 directory
-
- Target KQoX40/UxEnhance64.dll
- Size 3.1MB
- SHA256 79548729995423763dfc3149c03fe8444bbb2fb10629f5a94aa3d96f32c66a70
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1