Overview

overview

8

Static

static

1

batty.bat

windows11-21h2-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    batty.bat

  • Size

    4KB

  • Sample

    240929-h89f2axdnh

  • MD5

    0ed6d92eb6002975cab4b141fa8e48f9

  • SHA1

    3d81c6350ef10be62a7c6b175af44fa363d81feb

  • SHA256

    a51d5ba8a45986784cf36b41570e3071975bb22d7b50d7aec05742c68ec0ad55

  • SHA512

    0beea6db5a1c00c96e8cad70661e23647a9ba71f681d865b3c103ad86e2af1fa80acbbe1d7554b7c6034de7659b9853943a43d6b70f44e37aafbbab70baa1373

  • SSDEEP

    48:37l9BNXcf6iG2FK+8OEW9+HeEdUm/E2n23WwkFEeJE/sPEijE1Ms9Xc/fDKye9+j:37jEf8+8HFU22mZXMGEny/NKCDjT

Score
8/10
discoveryevasionexploitpersistenceprivilege_escalationspywarestealer

Malware Config

Targets

    • Target

      batty.bat

    • Size

      4KB

    • MD5

      0ed6d92eb6002975cab4b141fa8e48f9

    • SHA1

      3d81c6350ef10be62a7c6b175af44fa363d81feb

    • SHA256

      a51d5ba8a45986784cf36b41570e3071975bb22d7b50d7aec05742c68ec0ad55

    • SHA512

      0beea6db5a1c00c96e8cad70661e23647a9ba71f681d865b3c103ad86e2af1fa80acbbe1d7554b7c6034de7659b9853943a43d6b70f44e37aafbbab70baa1373

    • SSDEEP

      48:37l9BNXcf6iG2FK+8OEW9+HeEdUm/E2n23WwkFEeJE/sPEijE1Ms9Xc/fDKye9+j:37jEf8+8HFU22mZXMGEny/NKCDjT

    Score
    8/10
    discoveryevasionexploitpersistenceprivilege_escalationspywarestealer

    • Disables RegEdit via registry modification

      evasion

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Possible privilege escalation attempt

      exploit

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

File and Directory Permissions Modification

1
T1222

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

1
T1552

Credentials In Files

1
T1552.001

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Command and Control

Exfiltration

Impact

Tasks