Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
10-07-2024 11:50
General
-
Target
Plague crack/Launcher.bat
-
Size
45B
-
MD5
23e45603d9174a3c459e0f776395fce2
-
SHA1
45401deff1d3c0b621e524950c94e8746b2a73d0
-
SHA256
69f1cff5fe133b95f7d1ecb31328136816f21d232758d47c4afff91ef27f42ce
-
SHA512
af0bdbd88d5d828707a69b472e591fa20a1b808c5fec10b018ef28e7cae58172b374974773d1befd98ee1e6985d9d4e8267ef4d03f4fd3e87faef10457a3ab85
Malware Config
Signatures
-
UAC bypass 3 TTPs 1 IoCs
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 37 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Plague crack\Launcher.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Plague crack\Client.execlient.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Plague crack\Loader.exeLoader.exe2⤵
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\Plague crack\Loader.exe"C:\Users\Admin\AppData\Local\Temp\Plague crack\Loader.exe" explorer.exe1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5390d34e903b86af3619fd35dd30378c6
SHA10e2fedee3f816ae525643dd61d3841c57f99803a
SHA256d5a59b3315fce1989e6681262328e355f228a0691cef9b693d8b721c88830d1b
SHA512410f7d82cc51fd5ef4aef8d2cecbaebd833d600f2d1c942846302a6cce3f9cdf9823fcfd9b9daa7cf1988eb07c36dc7e3a240eaad1f0d3315270031129a2cedd
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
2.8MB
-
Filesize
4KB
-
Filesize
5.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
5.7MB