Overview

overview

10

Static

static

TRDKXFp3.bat

windows7_x64

10

TRDKXFp3.bat

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    TRDKXFp3.bat

  • Size

    197B

  • Sample

    200402-95haj95jqj

  • MD5

    9727c80f12d3336f330b3688e052968e

  • SHA1

    a20e98c967b46f66b2c7ebb51739ea41636b7f79

  • SHA256

    352f20fc1f8b8354ab0f610f5fdb66c11e24d56ba92f323df35200a0939ba674

  • SHA512

    faf8e17c7858c3163621f74dc918b491b591c9f99c9351d904b4653be79148e9495ad07e94f82a56506e132fbb4b256fdd36b1da0659fad778ef36369ee12bd6

Score
10/10
evasionpersistenceransomwarespywaretrojan

Malware Config

Extracted

Language
ps1
Source
URLs
ps1.dropper

http://185.103.242.78/pastes/TRDKXFp3

Targets

    • Target

      TRDKXFp3.bat

    • Size

      197B

    • MD5

      9727c80f12d3336f330b3688e052968e

    • SHA1

      a20e98c967b46f66b2c7ebb51739ea41636b7f79

    • SHA256

      352f20fc1f8b8354ab0f610f5fdb66c11e24d56ba92f323df35200a0939ba674

    • SHA512

      faf8e17c7858c3163621f74dc918b491b591c9f99c9351d904b4653be79148e9495ad07e94f82a56506e132fbb4b256fdd36b1da0659fad778ef36369ee12bd6

    Score
    10/10
    persistenceransomwareevasionspywaretrojan

    • Blacklisted process makes network request

    • Program crash

    • Discovering connected drives

    • Modifies system certificate store

      evasionspywaretrojan

    • Drops file in System32 directory

    • Modifies service

      persistence

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

3
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Defacement

1
T1491

Tasks