61d3ded7796d8e1e237a9d5b29dfa3c85bd8a7b0851158683b7182c8693efc5f | Triage

Sharing

General

Target

runasadmin.bat
Size

1KB
Sample

240522-wamq9sag3x
MD5

8c6d25434d4d9d6c230a727a90b3e111
SHA1

bb21e80767f6c2f6fcc382eeb0c67afc7294dae9
SHA256

61d3ded7796d8e1e237a9d5b29dfa3c85bd8a7b0851158683b7182c8693efc5f
SHA512

a9f81718046624aaf8c391e390dba81250f6c346e9aec4e929ca6a60eaecac5928ec961df91b2c520fa99b50481b8310192d8576cf1e20cb0d4129b8aadc194c

Score

10^/10

discovery evasion execution exploit

Malware Config

Targets

- Target
  
  runasadmin.bat
- Size
  
  1KB
- MD5
  
  8c6d25434d4d9d6c230a727a90b3e111
- SHA1
  
  bb21e80767f6c2f6fcc382eeb0c67afc7294dae9
- SHA256
  
  61d3ded7796d8e1e237a9d5b29dfa3c85bd8a7b0851158683b7182c8693efc5f
- SHA512
  
  a9f81718046624aaf8c391e390dba81250f6c346e9aec4e929ca6a60eaecac5928ec961df91b2c520fa99b50481b8310192d8576cf1e20cb0d4129b8aadc194c
Score

10^/10

discovery evasion execution exploit
- Disables service(s)
  evasion execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Modifies Windows Firewall
  evasion
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

System Services

Service Execution

Command and Scripting Interpreter

PowerShell

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

File and Directory Permissions Modification

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

Resource Development

Reconnaissance

Tasks

static1

behavioral1

discoveryevasionexecutionexploit