1b8c1fc80ad13c703485ddb7f6581584e5b538862287266b960f4994549214a3 | Triage

Sharing

General

Target

custom.bat
Size

2KB
Sample

240908-hf8c9ssamj
MD5

6482067516f0f24cdc0a596de66c951a
SHA1

9a77d1d6bc48250c98e57af675dec3a2dac51ed8
SHA256

1b8c1fc80ad13c703485ddb7f6581584e5b538862287266b960f4994549214a3
SHA512

25fa1d45b9a10e97cded264824bae7e2d149850d2e0a618b448f434aedee160b7f014dca765aadd501d064e952effe5393d0163dd0cfe1bd8c03de593c037e86

Score

8^/10

discovery evasion execution exploit persistence privilege_escalation

Malware Config

Targets

- Target
  
  custom.bat
- Size
  
  2KB
- MD5
  
  6482067516f0f24cdc0a596de66c951a
- SHA1
  
  9a77d1d6bc48250c98e57af675dec3a2dac51ed8
- SHA256
  
  1b8c1fc80ad13c703485ddb7f6581584e5b538862287266b960f4994549214a3
- SHA512
  
  25fa1d45b9a10e97cded264824bae7e2d149850d2e0a618b448f434aedee160b7f014dca765aadd501d064e952effe5393d0163dd0cfe1bd8c03de593c037e86
Score

8^/10

discovery execution exploit evasion persistence privilege_escalation
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Stops running service(s)
  evasion execution
- Modifies file permissions
  discovery
- Adds Run key to start application
  persistence
- Command and Scripting Interpreter: PowerShell
  Start PowerShell.
  execution
- Drops file in System32 directory
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

File and Directory Permissions Modification

Impair Defenses

Modify Registry

Credential Access

Discovery

Process Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

discoveryexecutionexploit

behavioral2

discoveryevasionexecutionexploitpersistence

behavioral3

discoveryexecution

behavioral4

discoveryevasionexecutionexploitpersistenceprivilege_escalation