Overview

overview

8

Static

static

1

Windows_Ac...ol.bat

windows7-x64

4

Windows_Ac...ol.bat

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    Windows_Activator_Tool.bat

  • Size

    435KB

  • Sample

    240503-jst7vacd23

  • MD5

    153799a818cb95fd5803fead4fbe3e7a

  • SHA1

    20c374986e4050265de2914c3993f6b22d6de460

  • SHA256

    835b99cbe7d16b1020a2b0fd94c356742528e94d66d445401b7057524c86ba3e

  • SHA512

    88af58dad86dd07be1f9fdbf6854f05579f2093360da939f52e8fd4c25f7cbbcdef0f1fe95bcedce00e0c88bf6c0a069f44cdb7be4f0b469ea2722d80e7eaa8c

  • SSDEEP

    3072:/xdR3S9mud2TrRMP0u+RciNiYbRd8nVFR3mP5sLtV7bJuAMTVFp6zGDNSCE2K0Y5:xbBHu+R7rLo97bJu9p6zGDNS0KROuCC

Score
8/10
discoveryexecutionexploitpersistence

Malware Config

Targets

    • Target

      Windows_Activator_Tool.bat

    • Size

      435KB

    • MD5

      153799a818cb95fd5803fead4fbe3e7a

    • SHA1

      20c374986e4050265de2914c3993f6b22d6de460

    • SHA256

      835b99cbe7d16b1020a2b0fd94c356742528e94d66d445401b7057524c86ba3e

    • SHA512

      88af58dad86dd07be1f9fdbf6854f05579f2093360da939f52e8fd4c25f7cbbcdef0f1fe95bcedce00e0c88bf6c0a069f44cdb7be4f0b469ea2722d80e7eaa8c

    • SSDEEP

      3072:/xdR3S9mud2TrRMP0u+RciNiYbRd8nVFR3mP5sLtV7bJuAMTVFp6zGDNSCE2K0Y5:xbBHu+R7rLo97bJu9p6zGDNS0KROuCC

    Score
    8/10
    discoveryexecutionexploitpersistence

    • Creates new service(s)

      persistenceexecution

    • Downloads MZ/PE file

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Possible privilege escalation attempt

      exploit

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Registers COM server for autorun

      persistence

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

1
T1064

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

2
T1112

Scripting

1
T1064

Subvert Trust Controls

1
T1553

SIP and Trust Provider Hijacking

1
T1553.003

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

5
T1012

Remote System Discovery

1
T1018

System Information Discovery

4
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks