General
- Target 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
- Size 112KB
- Sample260908-slsvwaswh1
- SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
Malware Config
Targets
-
- Target 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
- Size 112KB
- SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
Score8/10-
Modifies Windows Firewall
-
Possible privilege escalation attempt
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Modifies file permissions
-
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
-
Modifies boot configuration data using bcdedit
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1