Overview

overview

10

Static

static

10

get.ps1

windows7-x64

1

get.ps1

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    get.ps1

  • Size

    1KB

  • Sample

    240425-nrq61sac63

  • MD5

    6185481735a459173f53a4c39bf05ced

  • SHA1

    73db56dcfb54cc4ed558f8e1ead3441b542a24e0

  • SHA256

    825fd2904145a765334671e018e98e55ec62f4d1691d562431a71df0e47d3c86

  • SHA512

    61c8c67e77aecb650eda46fecbbf436333e2fb41e63d88ee71a160528c2dddaeafdce0936ac2b8c0a7d6e9cb06d0a80bc5a330a91a936a840315724b7c8e7ecf

Score
10/10
evasion

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://bitbucket.org/WindowsAddict/microsoft-activation-scripts/raw/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd
exe.dropper

https://codeberg.org/massgravel/Microsoft-Activation-Scripts/raw/commit/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd
exe.dropper

https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd

Targets

    • Target

      get.ps1

    • Size

      1KB

    • MD5

      6185481735a459173f53a4c39bf05ced

    • SHA1

      73db56dcfb54cc4ed558f8e1ead3441b542a24e0

    • SHA256

      825fd2904145a765334671e018e98e55ec62f4d1691d562431a71df0e47d3c86

    • SHA512

      61c8c67e77aecb650eda46fecbbf436333e2fb41e63d88ee71a160528c2dddaeafdce0936ac2b8c0a7d6e9cb06d0a80bc5a330a91a936a840315724b7c8e7ecf

    Score
    8/10
    evasion

    • Blocklisted process makes network request

    • Stops running service(s)

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Scheduled Task/Job

1
T1053

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

1
T1112

Credential Access

Discovery

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

Query Registry

4
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Resource Development

Reconnaissance

Tasks