General

  • Target

    testing2.bat

  • Size

    14KB

  • Sample

    240816-tyygkaybll

  • MD5

    e4846ee6a6427fcd98ca20e6d4e50aec

  • SHA1

    910c77705ea0e446823544eb251f8ca6ed95fb30

  • SHA256

    f25d0e768fc9dde8c8f01398c740d63a852339a9fd2b532334da00b064187751

  • SHA512

    b5c7789eff4241b630b2a7446a3124e0192d8b3247c4db33245315ccedd12436a6e45387ac30519897018f06ad1f119773f74dc01b324ea17f78ce58b7cc25a6

  • SSDEEP

    192:WTLtYH4fEmEdN40/IveIThAI8H6dDeOUczJUmcCTJftmN:WTLtbsb/IvZAI8H6dDed7mcCTJFmN

Malware Config

Targets

    • Target

      testing2.bat

    • Size

      14KB

    • MD5

      e4846ee6a6427fcd98ca20e6d4e50aec

    • SHA1

      910c77705ea0e446823544eb251f8ca6ed95fb30

    • SHA256

      f25d0e768fc9dde8c8f01398c740d63a852339a9fd2b532334da00b064187751

    • SHA512

      b5c7789eff4241b630b2a7446a3124e0192d8b3247c4db33245315ccedd12436a6e45387ac30519897018f06ad1f119773f74dc01b324ea17f78ce58b7cc25a6

    • SSDEEP

      192:WTLtYH4fEmEdN40/IveIThAI8H6dDeOUczJUmcCTJftmN:WTLtbsb/IvZAI8H6dDed7mcCTJFmN

    • Modifies Windows Defender Real-time Protection settings

    • Modifies Windows Defender notification settings

    • Modifies security service

    • UAC bypass

    • Modifies boot configuration data using bcdedit

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

    • Download via BitsAdmin

    • Modifies Windows Firewall

    • Modify Registry: Disable Windows Driver Blocklist

      Disable Windows Driver Blocklist via Registry.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Legitimate hosting services abused for malware hosting/C2

    • Modifies Security services

      Modifies the startup behavior of a security service.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks