Overview

overview

9

Static

static

1

Biggest Tw...ks.bat

windows7-x64

6

Biggest Tw...ks.bat

windows10-2004-x64

6

Biggest Tw...ff.bat

windows7-x64

4

Biggest Tw...ff.bat

windows10-2004-x64

4

Biggest Tw...er.bat

windows7-x64

1

Biggest Tw...er.bat

windows10-2004-x64

1

Biggest Tw...ng.bat

windows7-x64

8

Biggest Tw...ng.bat

windows10-2004-x64

8

Biggest Tw...n .bat

windows7-x64

1

Biggest Tw...n .bat

windows10-2004-x64

1

Biggest Tw...er.bat

windows7-x64

9

Biggest Tw...er.bat

windows10-2004-x64

9

Biggest Tw...es.bat

windows7-x64

8

Biggest Tw...es.bat

windows10-2004-x64

8

Biggest Tw...ns.bat

windows7-x64

1

Biggest Tw...ns.bat

windows10-2004-x64

1

Biggest Tw...ns.bat

windows7-x64

1

Biggest Tw...ns.bat

windows10-2004-x64

1

Biggest Tw...er.bat

windows7-x64

4

Biggest Tw...er.bat

windows10-2004-x64

4

Biggest Tw...ns.bat

windows7-x64

8

Biggest Tw...ns.bat

windows10-2004-x64

8

Biggest Tw...ch.bat

windows7-x64

1

Biggest Tw...ch.bat

windows10-2004-x64

1

Biggest Tw...wo.bat

windows7-x64

1

Biggest Tw...wo.bat

windows10-2004-x64

1

Biggest Tw...NS.bat

windows7-x64

1

Biggest Tw...NS.bat

windows10-2004-x64

1

Biggest Tw...ed.bat

windows7-x64

1

Biggest Tw...ed.bat

windows10-2004-x64

1

Biggest Tw...ks.bat

windows7-x64

1

Biggest Tw...ks.bat

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    0ed4ef8115f1c92f1500d2297e3e8f5b.bin

  • Size

    737KB

  • Sample

    240603-beek8seh36

  • MD5

    0ed4ef8115f1c92f1500d2297e3e8f5b

  • SHA1

    5527721625ee848eb426417e0078038b7716262f

  • SHA256

    d4dc352f244d7ece353619ac58c70216d182d0cb8aa8bafdeda815a9fd4d51da

  • SHA512

    76cde86e5d1f6408ae2fea38577037df9a491a9e3a5da2c9c2a7b1d1b805a33d4ed50c3b4be94ec37b5da154a9207d116fa69dec43ced862265f1d6010e742a1

  • SSDEEP

    12288:Sla3Ju7C/e7V+QDpmGVp4f1q9CBHJ2CKKb5kZW/XvjZ3ZMZmkTpUU:Wa//4VhDIGVpK1fBp2CKKb5kZ0ZMZrT5

Score
9/10
evasionexecutionpersistenceransomware

Malware Config

Targets

    • Target

      Biggest Tweaks/ExclusiveTweaks/BCDTweaks.bat

    • Size

      1KB

    • MD5

      02ba21af1e16d16f07a2c307b82c0fdd

    • SHA1

      0e0f9dca729c07c12c3c3c307599c6275282b05f

    • SHA256

      ebb64ad821cc0502f2da59ab70ce5deccd577a43a498ac1e705a233c1035c7ad

    • SHA512

      e59969ff73c830f8b2dd469c81d7902a23f49f142c51040b7cc690314a1bde850be3fc96ca360e66d4fe366f28a4c5770b38cfc107fb66f6750c242dc767b86c

    Score
    6/10

    • Modifies boot configuration data using bcdedit

    behavioral1behavioral2

    • Target

      Biggest Tweaks/ExclusiveTweaks/BluetoothOff.bat

    • Size

      954B

    • MD5

      bf24ea91432fd648f4901e283afbf6ae

    • SHA1

      7362a97e426aba7e7abc185ef1ab270eca00d51d

    • SHA256

      d8b94529395f23b844417de394526c08b55a8891d04a3bf501120cc94a514514

    • SHA512

      8e0fee8e59593eec9c399e044e77c26e84643481ebc6efe26c01b9f55247b89aeb4782d648787f6cd0f396b65ebff4d9856f85e815316ecb2ade55462eb071c7

    Score
    4/10
    behavioral3behavioral4

    • Target

      Biggest Tweaks/ExclusiveTweaks/CacheCleaner.bat

    • Size

      959B

    • MD5

      a95146951c76126e8c11ea6552aea1ca

    • SHA1

      22791b67876d702178f403fafa9c38aeeed7ae1f

    • SHA256

      357027a7ac8f31c736850abd1ab66ce23c2b0fedb0c1770e9788a2e750264c43

    • SHA512

      43b566ff7863efd859e2d47171d31dd25a17d50b6568808242c44089302efacafea875c9e845aff72ecf1d05694bda6b13f1590eeb37b7ac65eb4867fbf66584

    Score
    1/10
    behavioral5behavioral6

    • Target

      Biggest Tweaks/ExclusiveTweaks/DecreasePing.bat

    • Size

      320B

    • MD5

      949c439f75eaee73e656ca519b1613b1

    • SHA1

      d78974288f974b08765053935cacffa9503eae0d

    • SHA256

      8168ad056261ea8e197dcf201476040e1b2067c1f72983b35f99ce31763499fa

    • SHA512

      2e4d05a14d479cd4c4618fc29ab8c62e4a550cf80e89495b2482eb15161420e44a616de876017780c78633c226d033e184aafe0b511ed88112d59c2877f632f8

    Score
    8/10
    persistence

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral7behavioral8

    • Target

      Biggest Tweaks/ExclusiveTweaks/Delay Prioritization .bat

    • Size

      5KB

    • MD5

      35c8594e2ffe08b7325daec3badf1dfe

    • SHA1

      ef8235f1f95a23b3ca673940eaea9f748a997e49

    • SHA256

      289cf9572c9f72a71bfe69fb1d0ad5b13e5b16327db6fb41de30dc4679d156a6

    • SHA512

      6fd65bbd2961ff63923eaa52f70feb63738fb18e55a6a683d0660594324cdabbd6d8e17c4054afeee0b1525e68e009b336b6b3e7c2b5309059c3cf1e1916ebd3

    • SSDEEP

      96:bNffDFf4+a21QsjugjgWkXRYR7kR7sRP9rKYyhEgm+/OIG3HDFb:bNHDFw+JNCOIG3HDFb

    Score
    1/10
    behavioral10behavioral9

    • Target

      Biggest Tweaks/ExclusiveTweaks/DelayRemover.bat

    • Size

      1KB

    • MD5

      898854b530e15e55b303af02c61f23bf

    • SHA1

      6203913f3ef29362db02b245a00d255f8963c1fc

    • SHA256

      d569d8d611203b0f1aa9fe32e09ec2046138ea1da43dad2d24fd31e432ddf1bd

    • SHA512

      053f9927ac5ca16b22bdae65b73ea57a774894ef184e5bf8dd7c8462ed1997b284696553b60369d0a54051aa7ca31f6228b84e028f088d7f5e9541e0c6680ca0

    Score
    9/10
    evasionransomware
    behavioral11behavioral12

    • Target

      Biggest Tweaks/ExclusiveTweaks/DeleteUselessNetServices.bat

    • Size

      372B

    • MD5

      f91a83c456b84ebf27075e0bd2410b12

    • SHA1

      2731440439171503a609a1da1103d4d2a961da3a

    • SHA256

      954725069fee2854318111e6da8774a81b8838b34c0e0bdd690052f8fca32dd3

    • SHA512

      d06dc2320e8f1c8a887b07ebb25f6ae9796898b2408e1e6bf7c525fcc08353e8034972c29383e282843a7f70e9d3b5b8ad756999045e0999701364a7b7f0fd20

    Score
    8/10
    evasionexecution
    behavioral13behavioral14

    • Target

      Biggest Tweaks/ExclusiveTweaks/DisableMigitations.bat

    • Size

      301B

    • MD5

      0ad7e949fde870b9bedb749fee7960a9

    • SHA1

      7558f68eb22752b3f96882996492daa7d6b6ba40

    • SHA256

      b8b7a1632b78d617c28b7d7177fbba9a2330efff0fe6faec03eec51e467c3739

    • SHA512

      a2a046bcca87e21f5da5c287a6a75e01227d56a2ae9cdcfa2b4a4a603d4f30e7a1eb9af0e330a662a23ee79044e7bdb8c0ec944a2a6a50075eb832a92252fddc

    Score
    1/10
    behavioral15behavioral16

    • Target

      Biggest Tweaks/ExclusiveTweaks/DisableNotifications.bat

    • Size

      120B

    • MD5

      66cff148b0f911d104814a81f855065a

    • SHA1

      1f124820ae28cdb56bd466d4040238099dc9c3f8

    • SHA256

      4d3ce8a205b9911e25188ed2382e377641f1af7bbd248aab9a90968d6ac08e72

    • SHA512

      f6dfef76e038ae425a7f4320d4a44acb95ac7a57cbd971a35d14af7dc93a9fc679f1ebd57c3d4e7257b0ab3cc6fca22d48f1bd8dde2b9dd6cca92c826c6f1c57

    Score
    1/10
    behavioral17behavioral18

    • Target

      Biggest Tweaks/ExclusiveTweaks/DisablePrinter.bat

    • Size

      388B

    • MD5

      826ed19dbe86795de4937cf53b7827bc

    • SHA1

      2f9b04bbfa2c67838ad9e9971ad367633f97a6d4

    • SHA256

      c6c37aa777ce002139ec264213b50ce86d7dbdb4c407ccdab3dbff0c77fb5c60

    • SHA512

      f581f9e88c4c640ff613bf11691e305f27faae8d681a325c4b9da7317aab2554e9332c3b50feb00b8b75ad6d4960921eb67037fc127214d460fd13d49aaf7262

    Score
    4/10
    behavioral19behavioral20

    • Target

      Biggest Tweaks/ExclusiveTweaks/DisableProcessMigitations.bat

    • Size

      437B

    • MD5

      c4116b961e84c42b76bc9a5ffea9129b

    • SHA1

      3c024eaef14097c5bc91383c91ea7017c30d944c

    • SHA256

      b8349aac348de4f31fed561412e88fc478e25d844fd51b9d928bb945ac780080

    • SHA512

      21a0610e0733259032d2a401a14e71e7a7cbf923cce11008d33b07842d458fe273a30f55f45157ccaceea041c6e2cb4b70fa935fc54145a7cc08e6bb44dfc68d

    Score
    8/10
    executionpersistence
    behavioral21behavioral22

    • Target

      Biggest Tweaks/ExclusiveTweaks/Exclusive Folder Two/ExclusiveBatch.bat

    • Size

      8KB

    • MD5

      3bb4af11041fda0ce8bb183999a01fbe

    • SHA1

      5e9329ccb1d5c8bdb2ac2a98466f2f152f476304

    • SHA256

      b24d61379efea0e88b3e9f1bdfc16808cfe21ee19da15d2b18206d6ff9c9f5c6

    • SHA512

      da16325e70ca2479616add12508314c9fc8f977697a83fd322f8da24ce0269804df0073a44dd672662ceec4dbd8fd28b5b67734873e6477a95d5d54ffac38716

    • SSDEEP

      96:9tuqEgubsbq+bwCgip9x0BpQwRAGGYbM1r/nnvBk7ZqYMx:Yg5ggqpQyAGULn5cwYMx

    Score
    1/10
    behavioral23behavioral24

    • Target

      Biggest Tweaks/ExclusiveTweaks/Exclusive Folder Two/ExclusiveBatchTwo.bat

    • Size

      27KB

    • MD5

      a306c6bf359016c1eb84ad3eeb56834a

    • SHA1

      c1ec6c952742f45728108ed63487ab4feef97eaf

    • SHA256

      a41ed74c23ebae1196fa30348c4c8e7adad678486ece9ddc4647e4695b1ac86e

    • SHA512

      f14e43704a2e5276176d1dd45e8427cc7cd4a7442918877cad529836f82762cc6bcb4a623c1a927f249c04c292261b65f0d005cb4eeac5dcc15023dc5162dbb5

    • SSDEEP

      192:iVOXRgXg5ygzpQyAGMuLn5bLfohdeBYoAx:CKRgXgYg1QTuL5bLwgAx

    Score
    1/10
    behavioral25behavioral26

    • Target

      Biggest Tweaks/ExclusiveTweaks/FlushDNS.bat

    • Size

      18B

    • MD5

      f4920edf365f907261f3e1ea2c73887a

    • SHA1

      0ad7b591a3472bec364c084e041c42b5d5048710

    • SHA256

      998e9c67094be03bcf1b090bc5a57af2929d659f93037377ca4006e5713f1cb3

    • SHA512

      c5a1809087fa12382762f095f6db49b578e746d0a786f7c0e1bdb36405b7029aca63ea325d308f7d475ae150880fac9471207b262a1c5e976937a206e0ae6b45

    Score
    1/10
    behavioral27behavioral28

    • Target

      Biggest Tweaks/ExclusiveTweaks/IncreaseNetworkSpeed.bat

    • Size

      2KB

    • MD5

      c652b4efed97e796fc69051547bb0a1f

    • SHA1

      2c4e5a2adde39c704179dcca51c47bccad0269f7

    • SHA256

      5d88a7af6a0b28495a765a7d71359bf05e890b7a745fa81c2ffedb7d1ecd211d

    • SHA512

      c1b45989147dfcfce61a2c367722f80aaeb341740ab5f6e5376ca1561b885c0726f0ea7713f78fa77355826fffb9aca231fb5860e68bee9c90208fe824ca3316

    Score
    1/10
    behavioral29behavioral30

    • Target

      Biggest Tweaks/ExclusiveTweaks/KernelTweaks.bat

    • Size

      233B

    • MD5

      0aed4e24997517d54d4ea2770d1145d1

    • SHA1

      c465b503b0fb28fc3c334c8a57abf1f3ac5cb1aa

    • SHA256

      a59cb3adb06a9c8f3de98fcbfaccbf69efb3e5fa7fe6680606bc7beae34b6efe

    • SHA512

      e52e78c0b6914fb5bfa4e68abb2e703412afe09cb9089025cc42430573fb2e24708ba4ca1dd3162a8399ed43d1caa66cd994c704c04ba2ec1dddfdf697735ab1

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

PowerShell

1
T1059.001

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

3
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

3
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Service Stop

1
T1489

Tasks

static1

Score
1/10

behavioral1

Score
6/10

behavioral2

Score
6/10

behavioral3

Score
4/10

behavioral4

Score
4/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

persistence
Score
8/10

behavioral8

persistence
Score
8/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

evasionransomware
Score
9/10

behavioral12

evasionransomware
Score
9/10

behavioral13

evasionexecution
Score
8/10

behavioral14

evasionexecution
Score
8/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
4/10

behavioral20

Score
4/10

behavioral21

executionpersistence
Score
8/10

behavioral22

executionpersistence
Score
8/10

behavioral23

Score
1/10

behavioral24

Score
1/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10