General
- Target Solace.exe
- Size 4.2MB
- Sample260903-w4depaba67
- SHA256 1726cb7826ca3687d4e8f20d28cff02a34dbc6500ada6bd62217620603137443
Malware Config
Targets
-
- Target Solace.exe
- Size 4.2MB
- SHA256 1726cb7826ca3687d4e8f20d28cff02a34dbc6500ada6bd62217620603137443
Score10/10-
Modifies Windows Defender notification settings
-
UAC bypass
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Event Triggered Execution: Image File Execution Options Injection
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Disables automatic submission of suspicious files to Microsoft by Windows Defender
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
-
Disables service(s)
-
Executes dropped EXE
-
Modifies file permissions
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
2Windows Command Shell
1System Services
1Service Execution
1Windows Management Instrumentation
1Persistence
Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Image File Execution Options Injection
1