General
- Target NewFolder.exe
- Size 41KB
- Sample261001-w4mncsvt2j
- SHA256 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7
Score
10/10
Malware Config
Targets
-
- Target NewFolder.exe
- Size 41KB
- SHA256 70d98b736c32160617e8e272c2f5b2c10c72789fe40e27ec16f94ffa09394cd7
Score10/10-
Modifies WinLogon for persistence
-
Modifies visibility of file extensions in Explorer
-
Modifies visibility of hidden/system files in Explorer
-
Disables RegEdit via registry modification
-
Disables cmd.exe use via registry modification
-
Drops file in Drivers directory
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Executes a file named after a Windows system binary
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Masquerading
1Match Legitimate Name or Location
1Modify Registry
4