General
- Target loader.exe
- Size 13.4MB
- Sample260916-rv2cya1gpg
- SHA256 069922c0bb6b65a032a0d07053ec25074b8e122c697da1bc726724a5ddb0246d
Malware Config
Targets
-
- Target loader.exe
- Size 13.4MB
- SHA256 069922c0bb6b65a032a0d07053ec25074b8e122c697da1bc726724a5ddb0246d
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Drops file in Drivers directory
-
Executes dropped EXE
-
Loads dropped DLL
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Network Share Discovery
Attempt to gather information on host network.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
Impair Defenses
1Disable or Modify Tools
1Pre-OS Boot
1Bootkit
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
4System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1