General
-
Target
testing2.bat
-
Size
14KB
-
Sample
240816-tyygkaybll
-
MD5
e4846ee6a6427fcd98ca20e6d4e50aec
-
SHA1
910c77705ea0e446823544eb251f8ca6ed95fb30
-
SHA256
f25d0e768fc9dde8c8f01398c740d63a852339a9fd2b532334da00b064187751
-
SHA512
b5c7789eff4241b630b2a7446a3124e0192d8b3247c4db33245315ccedd12436a6e45387ac30519897018f06ad1f119773f74dc01b324ea17f78ce58b7cc25a6
-
SSDEEP
192:WTLtYH4fEmEdN40/IveIThAI8H6dDeOUczJUmcCTJftmN:WTLtbsb/IvZAI8H6dDed7mcCTJFmN
Static task
static1
Behavioral task
behavioral1
Sample
testing2.bat
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
testing2.bat
-
Size
14KB
-
MD5
e4846ee6a6427fcd98ca20e6d4e50aec
-
SHA1
910c77705ea0e446823544eb251f8ca6ed95fb30
-
SHA256
f25d0e768fc9dde8c8f01398c740d63a852339a9fd2b532334da00b064187751
-
SHA512
b5c7789eff4241b630b2a7446a3124e0192d8b3247c4db33245315ccedd12436a6e45387ac30519897018f06ad1f119773f74dc01b324ea17f78ce58b7cc25a6
-
SSDEEP
192:WTLtYH4fEmEdN40/IveIThAI8H6dDeOUczJUmcCTJftmN:WTLtbsb/IvZAI8H6dDed7mcCTJFmN
-
Modifies security service
-
Modifies boot configuration data using bcdedit
-
Download via BitsAdmin
-
Modifies Windows Firewall
-
Modify Registry: Disable Windows Driver Blocklist
Disable Windows Driver Blocklist via Registry.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Drops file in System32 directory
-
MITRE ATT&CK Enterprise v15
Persistence
BITS Jobs
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Installer Packages
1Netsh Helper DLL
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1BITS Jobs
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
8System Binary Proxy Execution
1Msiexec
1