Overview

overview

10

Static

static

1

dont run this.bat

windows7-x64

10

dont run this.bat

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    dont run this.bat
  • Size 849B
  • Sample240603-nl142aeb67
  • SHA256 5fa54e25da95bc1653386095036e5e49674eaf32a84abf5260d06766939b3c2b
  • MD5 SHA1 SHA512
Score
10/10
executionpersistence

Malware Config

Extracted

Language

  • ps1

Source
URLs
  • exe.dropper

    https://discord.com/api/webhooks/1247011829113421924/G7H0e1jRD0We6lVEwOvpi4hMvIPUhb5TglUInY9mdGy6MSxXFUT5tl3x_3jw9dhg1Pk8

Targets

    • Target
      dont run this.bat
    • Size 849B
    • SHA256 5fa54e25da95bc1653386095036e5e49674eaf32a84abf5260d06766939b3c2b
    • MD5 SHA1 SHA512
    Score
    10/10
    executionpersistence

    • Blocklisted process makes network request

    • Modifies Installed Components in the registry

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks