General
- Target 24122024.rar
- Size 446KB
- Sample260827-cea4gswzbv
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
Malware Config
Targets
-
- Target 24122024/Defender_Settings.vbs
- Size 313B
- SHA256 af42a17d428c8e9d6f4a6d3393ec268f4d12bbfd01a897d87275482a45c847e9
Score5/10-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
- Target 24122024/dControl.exe
- Size 447KB
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
Score10/10-
Modifies Windows Defender DisableAntiSpyware settings
-
Modifies Windows Defender TamperProtection settings
-
Modifies firewall policy service
-
Modifies security service
-
Windows security bypass
-
Event Triggered Execution: Image File Execution Options Injection
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Windows security modification
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Modifies Security services
Modifies the startup behavior of a security service.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
8