General
- Target 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
- Size 16KB
- Sample260910-3xspcsxejb
- SHA256 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
Malware Config
Targets
-
- Target 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
- Size 16KB
- SHA256 034f7ae294e70be0c8d91553111bc17e7542fe651a7a68203f20255b1b7e079a
Score9/10-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Remote Service Session Hijacking: RDP Hijacking
Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Modifies RDP port number used by Windows
-
Modifies Windows Firewall
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Creates a new local user account
Uses net.exe to create a new local user account, often for persistence or a backdoor account.
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create Account
1Local Account
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Impair Defenses
2Disable or Modify System Firewall
1Disable or Modify Tools
1Discovery
Permission Groups Discovery
1Local Groups
1System Network Configuration Discovery
1Internet Connection Discovery
1