87de37590bb74823203e44a5dedd6038316c3aae1f7a8c02493c40a896382d5f | Triage

Sharing

General

Target

reset.bat
Size

2KB
Sample

240920-avz2fazala
MD5

f923fafd8c7c34387a9e71ffd0e1ad3d
SHA1

81827e222c0115e054c74d0c7718a98cc554d849
SHA256

87de37590bb74823203e44a5dedd6038316c3aae1f7a8c02493c40a896382d5f
SHA512

785258115d8adc38e95aa4cf548d588281bfded3428bb15a34e910c6e85ab01fbb79172c12ee9f51246d1db2246a2ff027a75618a0b08f614f04749c3c0fc3ab

Score

10^/10

evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  reset.bat
- Size
  
  2KB
- MD5
  
  f923fafd8c7c34387a9e71ffd0e1ad3d
- SHA1
  
  81827e222c0115e054c74d0c7718a98cc554d849
- SHA256
  
  87de37590bb74823203e44a5dedd6038316c3aae1f7a8c02493c40a896382d5f
- SHA512
  
  785258115d8adc38e95aa4cf548d588281bfded3428bb15a34e910c6e85ab01fbb79172c12ee9f51246d1db2246a2ff027a75618a0b08f614f04749c3c0fc3ab
Score

10^/10

evasion persistence privilege_escalation trojan
- Windows security bypass
  evasion trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Disables Task Manager via registry modification
  evasion
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Event Triggered Execution

Component Object Model Hijacking

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Event Triggered Execution

Component Object Model Hijacking

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistenceprivilege_escalationtrojan

behavioral2

evasionpersistenceprivilege_escalationtrojan

behavioral3

evasionpersistencetrojan