Overview

overview

10

Static

static

1

WinBlocker.bat

windows7-x64

10

WinBlocker.bat

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    WinBlocker.bat

  • Size

    2KB

  • Sample

    240806-c4v5ysxbjk

  • MD5

    1b5a43b427cbec4b2d98381bd745f252

  • SHA1

    e35fa4eb5b4d03de11e34b648ccd0eb3bf64aca9

  • SHA256

    16a9fd99658aec5a790b84002e2bd1388d82f0b0ac8d951fc65195ca4f3305af

  • SHA512

    3689f9000a0ce44ba4a1503f59e3b94706ff9f73cc6baeb0f1105971c1c3fdc39373d091c8187ad681af8e4954bd0bca602ced76f080faa1c2f4082219c085a5

Score
10/10
evasionpersistencetrojan

Malware Config

Targets

    • Target

      WinBlocker.bat

    • Size

      2KB

    • MD5

      1b5a43b427cbec4b2d98381bd745f252

    • SHA1

      e35fa4eb5b4d03de11e34b648ccd0eb3bf64aca9

    • SHA256

      16a9fd99658aec5a790b84002e2bd1388d82f0b0ac8d951fc65195ca4f3305af

    • SHA512

      3689f9000a0ce44ba4a1503f59e3b94706ff9f73cc6baeb0f1105971c1c3fdc39373d091c8187ad681af8e4954bd0bca602ced76f080faa1c2f4082219c085a5

    Score
    10/10
    evasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Disables Task Manager via registry modification

      evasion

    • Drops file in Drivers directory

    • Manipulates Digital Signatures

      Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.

    • Boot or Logon Autostart Execution: Print Processors

      Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

      persistence

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    • Modifies termsrv.dll

      Commonly used to allow simultaneous RDP sessions.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

2
T1547

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

2
T1547

Print Processors

1
T1547.012

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

Lateral Movement

Remote Services

1
T1021

Remote Desktop Protocol

1
T1021.001

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks