Extracted

• • Target

    slut_keep_admin.bat

  • Size

    1KB

  • MD5

    9152962b6cef0d476f4e89127d8f0255

  • SHA1

    b3b0b2686f0b27eff516ca35443feff8ff5f8026

  • SHA256

    70fbc646366a3184c596ed7cba7055f1405350d164d104fcf4c2eec71c9d6434

  • SHA512

    b609ecc36ea6e417b45099092d1511da78af19855252cbf5050d30abd6d2ee3def57518c5c8676e25e0786cfd22c7bd5dcd98a4da725db2fa102256ad4f3d80e

  Score

  10^/10

  executionadwaredefense_evasiondiscoveryevasionpersistencephishingprivilege_escalationransomwarestealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Downloads MZ/PE file

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Sets file to hidden

    Modifies file attributes to stop it showing in Explorer etc.

    evasion

  • A potential corporate email address has been identified in the URL: Mypchasbeenclaimedby@swtakeover2doyoualsowanttobeclaimedhttpstwitter.comswtakeover2

    phishing

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2