496ba960a9fdf59b00191e7750cfc3940fe5a49610988799cbe3d9cc5d3f5344 | Triage

Resubmissions

15-08-2024 18:38

240815-xaelbs1hpj 10

15-08-2024 18:24

240815-w14sgawfrc 8

Sharing

General

Target

new.bat
Size

18.0MB
Sample

240815-w14sgawfrc
MD5

35168f928a81982fc428113f484ea21e
SHA1

2029d685911c351cea2857e12c1755df330e4978
SHA256

496ba960a9fdf59b00191e7750cfc3940fe5a49610988799cbe3d9cc5d3f5344
SHA512

4b2dc4e91c04180cb372460231e75270252f389231d759bcd96af05dbb479647d39e860e3f22dcf7041e8ec214a1a12125e8ccf52cd26f87d13ee163d58726ec
SSDEEP

48:HmGJ3NlBmmTaQgTymDyb4J7rmxo6rmxoAbYk8OkeFhCaoe1aLHtZQ5ImvBSygyGV:H9FmmNfjwhSCu7OmLT7SkoLEu3S0yhr

Score

8^/10

execution

Malware Config

Targets

- Target
  
  new.bat
- Size
  
  18.0MB
- MD5
  
  35168f928a81982fc428113f484ea21e
- SHA1
  
  2029d685911c351cea2857e12c1755df330e4978
- SHA256
  
  496ba960a9fdf59b00191e7750cfc3940fe5a49610988799cbe3d9cc5d3f5344
- SHA512
  
  4b2dc4e91c04180cb372460231e75270252f389231d759bcd96af05dbb479647d39e860e3f22dcf7041e8ec214a1a12125e8ccf52cd26f87d13ee163d58726ec
- SSDEEP
  
  48:HmGJ3NlBmmTaQgTymDyb4J7rmxo6rmxoAbYk8OkeFhCaoe1aLHtZQ5ImvBSygyGV:H9FmmNfjwhSCu7OmLT7SkoLEu3S0yhr
Score

8^/10

execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2