General
- Target Naenara.exe
- Size 9.2MB
- Sample261108-phra4acx7p
- SHA256 bff8ef5dccbec8801164cf8d90b8bd80b0e7638ec25afdba0fbcc76b0fdbad82
Score
8/10
Malware Config
Targets
-
- Target Naenara.exe
- Size 9.2MB
- SHA256 bff8ef5dccbec8801164cf8d90b8bd80b0e7638ec25afdba0fbcc76b0fdbad82
Score8/10Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Possible privilege escalation attempt
Modifies file permissions
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
File and Directory Permissions Modification: Windows File and Directory Permissions Modification
Uses WMI to collect hardware manufacturer information
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Windows Management Instrumentation
2Defense Evasion
File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Hide Artifacts
1Hidden Files and Directories
1Virtualization/Sandbox Evasion
1System Checks
1