2448b4bfa9222ae820aee98970b89a899156a2778bc753501ef889d40ba5e07b

General

Target

Full v1.bat
Size

119KB
MD5

f5b9b3022efa6f923eea1db999c035eb
SHA1

58b4d2b18f667da319c55a627d2f1dcf0ede3d62
SHA256

2448b4bfa9222ae820aee98970b89a899156a2778bc753501ef889d40ba5e07b
SHA512

b76f2830efbcf60dfa191adcfce1acbbea299a10554c7b6c8f8ed4c269e5da851e9b11bed1bd284058e151a8778f66f70728239f502f8a96701d2d27fbb80248
SSDEEP

768:y/4N6AiYQeeX3BG//6epUhIIqWq60/YscQfzQhFuXLnV6/PF2WlkrOfY/+wkPsiH:OTIIqWz0KQIIqWz0Kq

Score

10^/10

evasion execution trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2856	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2856	powershell.exe
2856	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2856	powershell.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2748	2316	cmd.exe	79
PID 2316 wrote to memory of 2748	2316	cmd.exe	79
PID 2316 wrote to memory of 3064	2316	cmd.exe	80
PID 2316 wrote to memory of 3064	2316	cmd.exe	80
PID 2316 wrote to memory of 2884	2316	cmd.exe	81
PID 2316 wrote to memory of 2884	2316	cmd.exe	81
PID 2316 wrote to memory of 1364	2316	cmd.exe	82
PID 2316 wrote to memory of 1364	2316	cmd.exe	82
PID 2316 wrote to memory of 1552	2316	cmd.exe	83
PID 2316 wrote to memory of 1552	2316	cmd.exe	83
PID 2316 wrote to memory of 4820	2316	cmd.exe	84
PID 2316 wrote to memory of 4820	2316	cmd.exe	84
PID 2316 wrote to memory of 2856	2316	cmd.exe	85
PID 2316 wrote to memory of 2856	2316	cmd.exe	85
PID 2316 wrote to memory of 1932	2316	cmd.exe	88
PID 2316 wrote to memory of 1932	2316	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Full v1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2748
- C:\Windows\system32\reg.exe
  Reg.exe ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA" /t REG_DWORD /d "0" /f
  2⤵
  - UAC bypass
  PID:3064
- C:\Windows\system32\reg.exe
  Reg.exe add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
  2⤵
  PID:2884
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "RPSessionInterval" /f
  2⤵
  PID:1364
- C:\Windows\system32\reg.exe
  Reg.exe delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SystemRestore" /v "DisableConfig" /f
  2⤵
  PID:1552
- C:\Windows\system32\reg.exe
  Reg.exe add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v "SystemRestorePointCreationFrequency" /t REG_DWORD /d 0 /f
  2⤵
  PID:4820
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Unrestricted -NoProfile Enable-ComputerRestore -Drive 'C:\'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2856
- C:\Windows\system32\chcp.com
  chcp 65001
  2⤵
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u2p2dg4o.ulx.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2856-0-0x00007FFEE2653000-0x00007FFEE2655000-memory.dmp

Filesize
8KB

Download
memory/2856-1-0x00000114E5D70000-0x00000114E5D92000-memory.dmp

Filesize
136KB

Download
memory/2856-10-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Filesize
10.8MB

Download
memory/2856-11-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Filesize
10.8MB

Download
memory/2856-12-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Filesize
10.8MB

Download
memory/2856-15-0x00007FFEE2650000-0x00007FFEE3112000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads