General
- Target 1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19.exe
- Size 5.0MB
- Sample260810-d4zntadh33
- SHA256 1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19
Score
10/10
Malware Config
Targets
-
- Target 1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19.exe
- Size 5.0MB
- SHA256 1a1c8fcea547dfad3108c36f696da9548fb08c2b977d06288d04e1cfbe950b19
Score10/10Modifies security service
Suspicious use of NtCreateUserProcessOtherParentProcess
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
Server Software Component: Terminal Services DLL
Sets service image path in registry
This determines the executable launched when a service starts. It can be used to establish persistence.
Creates new service(s)
Deletes itself
Disables service(s)
Executes dropped EXE
Stops running service(s)
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
Drops file in System32 directory
Suspicious use of SetThreadContext
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1System Services
3Service Execution
3Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Power Settings
1Server Software Component
1Terminal Services DLL
1