General
- Target file.exe
- Size 5.5MB
- Sample261012-3pht7ay14j
- SHA256 8ad7f56f8701807d0b089d520d2f2625b20aaf06777ac0c4c79edb3ae1395aea
Score
10/10
Malware Config
Targets
-
- Target file.exe
- Size 5.5MB
- SHA256 8ad7f56f8701807d0b089d520d2f2625b20aaf06777ac0c4c79edb3ae1395aea
Score10/10-
Suspicious use of NtCreateUserProcessOtherParentProcess
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Creates new service(s)
-
Executes dropped EXE
-
Stops running service(s)
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1System Services
2Service Execution
2Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Create or Modify System Process
2Windows Service
2Process Injection
1Process Hollowing
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Process Injection
1Process Hollowing
1