Overview

overview

8

Static

static

1

URLScan

urlscan

http://start-process...

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    http://start-process PowerShell -verb runas

  • Sample

    240627-mc3qtsyelj

Score
8/10
microsoftdefense_evasiondiscoveryevasionexecutionpersistencephishingprivilege_escalationupx

Malware Config

Targets

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Command and Scripting Interpreter

1
T1059

Persistence

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

2
T1543

Windows Service

2
T1543.003

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Access Token Manipulation

1
T1134

Create Process with Token

1
T1134.002

Credential Access

Discovery

Query Registry

4
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks