ea4b610f369125f841978184a437e130132dfcdcd28e31340c8d000cceb86b88 | Triage

Sharing

General

Target

Lifenz Utility - Made By My Friend.bat
Size

229KB
Sample

240920-vv5bdaxgmd
MD5

f58bacec0fcb2556102b6d6922c19866
SHA1

f2e645e168b7557abe72807bed452d4f7ef8a54c
SHA256

ea4b610f369125f841978184a437e130132dfcdcd28e31340c8d000cceb86b88
SHA512

8c89d7eb67d1ca17f525bcc15d99689ccf5ad4765766ceb4cc23b4c1dd1893c33a79efb1bc7d90e20511ceca7aeeb504a63c69adb377f10f5509dc1239ac912a
SSDEEP

768:fa+HkgKBWQq+jAcTtGiZQVr6r6Pk6PUXfCV1nFLPqoCo+0CQxwywh1ZIa1WsOKEf:faozQHdCbFB+uxwhO

Score

10^/10

discovery evasion execution trojan

Malware Config

Targets

- Target
  
  Lifenz Utility - Made By My Friend.bat
- Size
  
  229KB
- MD5
  
  f58bacec0fcb2556102b6d6922c19866
- SHA1
  
  f2e645e168b7557abe72807bed452d4f7ef8a54c
- SHA256
  
  ea4b610f369125f841978184a437e130132dfcdcd28e31340c8d000cceb86b88
- SHA512
  
  8c89d7eb67d1ca17f525bcc15d99689ccf5ad4765766ceb4cc23b4c1dd1893c33a79efb1bc7d90e20511ceca7aeeb504a63c69adb377f10f5509dc1239ac912a
- SSDEEP
  
  768:fa+HkgKBWQq+jAcTtGiZQVr6r6Pk6PUXfCV1nFLPqoCo+0CQxwywh1ZIa1WsOKEf:faozQHdCbFB+uxwhO
Score

10^/10

discovery evasion execution trojan
- UAC bypass
  evasion trojan
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Impair Defenses

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryevasionexecutiontrojan