General
- Target 24122024.rar
- Size 446KB
- Sample261014-nesjbafg79
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
Malware Config
Targets
-
- Target 24122024.rar
- Size 446KB
- SHA256 b378d7f1fa1cffa05b55917225232224ff0b13a1d739feac017c7fe56f1b3adb
Score10/10Modifies Windows Defender TamperProtection settings
Modifies firewall policy service
Modifies security service
Suspicious use of NtCreateProcessExOtherParentProcess
Windows security bypass
Downloads MZ/PE file
Modifies Windows Firewall
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Modifies Security services
Modifies the startup behavior of a security service.
AutoIT Executable
AutoIT scripts compiled to PE executables.
Drops file in System32 directory
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
5Disable or Modify System Firewall
2Disable or Modify Tools
2Modify Registry
7