Overview

overview

10

Static

static

10

get.ps1

windows7-x64

3

get.ps1

windows10-2004-x64

8

Resubmissions

07-08-2024 04:42

240807-fbybds1fkp 10

25-04-2024 11:38

240425-nrq61sac63 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    get.ps1

  • Size

    1KB

  • Sample

    240807-fbybds1fkp

  • MD5

    6185481735a459173f53a4c39bf05ced

  • SHA1

    73db56dcfb54cc4ed558f8e1ead3441b542a24e0

  • SHA256

    825fd2904145a765334671e018e98e55ec62f4d1691d562431a71df0e47d3c86

  • SHA512

    61c8c67e77aecb650eda46fecbbf436333e2fb41e63d88ee71a160528c2dddaeafdce0936ac2b8c0a7d6e9cb06d0a80bc5a330a91a936a840315724b7c8e7ecf

Score
10/10
defense_evasiondiscoveryexecution

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://bitbucket.org/WindowsAddict/microsoft-activation-scripts/raw/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd
exe.dropper

https://codeberg.org/massgravel/Microsoft-Activation-Scripts/raw/commit/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd
exe.dropper

https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/984b384d9e5facc222eecaa07b78def265395321/MAS/All-In-One-Version/MAS_AIO-CRC32_8B16F764.cmd

Targets

    • Target

      get.ps1

    • Size

      1KB

    • MD5

      6185481735a459173f53a4c39bf05ced

    • SHA1

      73db56dcfb54cc4ed558f8e1ead3441b542a24e0

    • SHA256

      825fd2904145a765334671e018e98e55ec62f4d1691d562431a71df0e47d3c86

    • SHA512

      61c8c67e77aecb650eda46fecbbf436333e2fb41e63d88ee71a160528c2dddaeafdce0936ac2b8c0a7d6e9cb06d0a80bc5a330a91a936a840315724b7c8e7ecf

    Score
    8/10
    executiondefense_evasiondiscovery

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Checks for any installed AV software in registry

    • Legitimate hosting services abused for malware hosting/C2

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

4
T1012

Remote System Discovery

1
T1018

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

4
T1082

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

System Time Discovery

1
T1124

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Tasks