d9b401dd2495e591be1e920ef4c3bf92a8b25fa89cf3303d31a4efd408624a1e | Triage

Sharing

General

Target

DemonWareCleaner.bat
Size

5.5MB
Sample

240818-c9s8js1dma
MD5

699d62ce0f1d6e6f4a390fa659d4c865
SHA1

90432c23a1863e279de94c3e4ca1b585e6ecb334
SHA256

d9b401dd2495e591be1e920ef4c3bf92a8b25fa89cf3303d31a4efd408624a1e
SHA512

7533744e67a8dd8579016cb2174518fec653aa983b914249898100be4bcd12545b3da9796bfd9ce9650e2543e52ef57a9ef0470abe834554ab9521e5dbfc10c6
SSDEEP

49152:kTOB4ynYygOvXsMruROZyUpWvWOLZkORe2TOB4ynYygOvXsMruROZyUpWvWOLZkK:C

Score

10^/10

discovery evasion execution persistence privilege_escalation

Malware Config

Targets

- Target
  
  DemonWareCleaner.bat
- Size
  
  5.5MB
- MD5
  
  699d62ce0f1d6e6f4a390fa659d4c865
- SHA1
  
  90432c23a1863e279de94c3e4ca1b585e6ecb334
- SHA256
  
  d9b401dd2495e591be1e920ef4c3bf92a8b25fa89cf3303d31a4efd408624a1e
- SHA512
  
  7533744e67a8dd8579016cb2174518fec653aa983b914249898100be4bcd12545b3da9796bfd9ce9650e2543e52ef57a9ef0470abe834554ab9521e5dbfc10c6
- SSDEEP
  
  49152:kTOB4ynYygOvXsMruROZyUpWvWOLZkORe2TOB4ynYygOvXsMruROZyUpWvWOLZkK:C
Score

10^/10

discovery evasion execution persistence privilege_escalation
- Disables service(s)
  evasion execution
- Server Software Component: Terminal Services DLL
  persistence
- Stops running service(s)
  evasion execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Server Software Component

Terminal Services DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryevasionexecutionpersistenceprivilege_escalation