Overview

overview

10

Static

static

1

WinBlocker.bat

windows7-x64

10

WinBlocker.bat

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    WinBlocker.bat

  • Size

    2KB

  • Sample

    240805-lrerwaserl

  • MD5

    5bedb5a6e2c853ec83cf3799ff0b31b6

  • SHA1

    10e16def6fc0947ae1457ce58a9ed16389aff192

  • SHA256

    63e9346405f7c0804495d58d3afc5d4a9584b222a807626e6068223f9f29ee8d

  • SHA512

    61f3ae9896ab6862edd12eb9a2e92d2b1f6de021c0ba2a57002ce613e885afab68b8c384e1457a37135e839175f734216df368e9ad86655a777fe1db110074d4

Score
10/10
evasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      WinBlocker.bat

    • Size

      2KB

    • MD5

      5bedb5a6e2c853ec83cf3799ff0b31b6

    • SHA1

      10e16def6fc0947ae1457ce58a9ed16389aff192

    • SHA256

      63e9346405f7c0804495d58d3afc5d4a9584b222a807626e6068223f9f29ee8d

    • SHA512

      61f3ae9896ab6862edd12eb9a2e92d2b1f6de021c0ba2a57002ce613e885afab68b8c384e1457a37135e839175f734216df368e9ad86655a777fe1db110074d4

    Score
    10/10
    evasionpersistenceprivilege_escalationtrojan

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Modifies termsrv.dll

      Commonly used to allow simultaneous RDP sessions.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

1
T1547.001

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Remote Services

1
T1021

Remote Desktop Protocol

1
T1021.001

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks