General
- Target 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
- Size 112KB
- Sample260908-srh8matapf
- SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
Malware Config
Targets
-
- Target 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb.exe
- Size 112KB
- SHA256 9b49b86c88117138c7dbf0b1ffdcf2ec3d193ffdb44cdbdd96c2899d260dfffb
Score8/10Modifies Windows Firewall
Possible privilege escalation attempt
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
Modifies file permissions
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Modifies boot configuration data using bcdedit
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
Drops file in System32 directory
Executes a VBScript file via the Windows Script Host.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3Visual Basic
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Deobfuscate/Decode Files or Information
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1