General
- Target EXM Premium.exe
- Size 4.3MB
- Sample260906-186dgsde59
- SHA256 0f06ce2e99438c75168501d4c3a5a9ae3c072ba9273848837964d7ca71e46cb7
Score
10/10
Malware Config
Targets
-
- Target EXM Premium.exe
- Size 4.3MB
- SHA256 0f06ce2e99438c75168501d4c3a5a9ae3c072ba9273848837964d7ca71e46cb7
Score10/10-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4JavaScript
1PowerShell
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1