Overview

overview

8

Static

static

1

file01.ps1

windows7-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    file01.ps1

  • Size

    3B

  • Sample

    240504-tbnc3sdc86

  • MD5

    7815696ecbf1c96e6894b779456d330e

  • SHA1

    f10e2821bbbea527ea02200352313bc059445190

  • SHA256

    688787d8ff144c502c7f5cffaafe2cc588d86079f9de88304c26b0cb99ce91c6

  • SHA512

    e54ee7e285fbb0275279143abc4c554e5314e7b417ecac83a5984a964facbaad68866a2841c3e83ddf125a2985566261c4014f9f960ec60253aebcda9513a9b4

Score
8/10
discoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target

      file01.ps1

    • Size

      3B

    • MD5

      7815696ecbf1c96e6894b779456d330e

    • SHA1

      f10e2821bbbea527ea02200352313bc059445190

    • SHA256

      688787d8ff144c502c7f5cffaafe2cc588d86079f9de88304c26b0cb99ce91c6

    • SHA512

      e54ee7e285fbb0275279143abc4c554e5314e7b417ecac83a5984a964facbaad68866a2841c3e83ddf125a2985566261c4014f9f960ec60253aebcda9513a9b4

    Score
    8/10
    discoveryexecutionpersistencespywarestealer

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Modifies Installed Components in the registry

      persistence

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Registers COM server for autorun

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks