General
- Target remove_FortiEDRBaseDriver_6.1.1.1292_script.bat
- Size 603B
- Sample260910-y5bzcsgl91
- SHA256 f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e
Score
8/10
Malware Config
Targets
-
- Target remove_FortiEDRBaseDriver_6.1.1.1292_script.bat
- Size 603B
- SHA256 f6cec063102760b67df60c1d19799348560425841af06a46b9d1084fa2f0591e
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Stops running service(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Create or Modify System Process
1Windows Service
1