Overview

overview

10

Static

static

1

Adil Windo...py.bat

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Adil Windows - Copy.bat

  • Size

    12KB

  • Sample

    241205-h5b2cszpaq

  • MD5

    2a7086b99fea895c2f2ed23abe77c93c

  • SHA1

    54c39b64f373be5a397e67c10bb17259b6aa7595

  • SHA256

    37705c3cda6ed05001d551d5bd262fbf3163d11338e0c2179ba1db231a7e07f6

  • SHA512

    ebd731316d435edad6ec6b5cde0b5b44166e74e518dc1efc586c733f58a96da4561eb8daa7785107e6c4343c9a44b5db230b0bacf7797afed806e28c15db0c14

  • SSDEEP

    192:AAAcaDMED9DPGeO7D8HqRvfgvpoVN3cP7b8T0zN:zAfoMGeO7D8YjVN3BIN

Score
10/10
defense_evasiondiscoveryevasionexecutionlateral_movementpersistenceprivilege_escalationransomwaretrojan

Malware Config

Targets

    • Target

      Adil Windows - Copy.bat

    • Size

      12KB

    • MD5

      2a7086b99fea895c2f2ed23abe77c93c

    • SHA1

      54c39b64f373be5a397e67c10bb17259b6aa7595

    • SHA256

      37705c3cda6ed05001d551d5bd262fbf3163d11338e0c2179ba1db231a7e07f6

    • SHA512

      ebd731316d435edad6ec6b5cde0b5b44166e74e518dc1efc586c733f58a96da4561eb8daa7785107e6c4343c9a44b5db230b0bacf7797afed806e28c15db0c14

    • SSDEEP

      192:AAAcaDMED9DPGeO7D8HqRvfgvpoVN3cP7b8T0zN:zAfoMGeO7D8YjVN3BIN

    Score
    10/10
    defense_evasiondiscoveryevasionexecutionlateral_movementpersistenceprivilege_escalationransomwaretrojan

    • Disables service(s)

      evasionexecution

    • UAC bypass

      evasiontrojan

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasionexecution

    • Allows Network login with blank passwords

      Allows local user accounts with blank passwords to access device from the network.

    • Hijack Execution Flow: Executable Installer File Permissions Weakness

      Possible Turn off User Account Control's privilege elevation for standard users.

      defense_evasionpersistenceprivilege_escalation

    • Password Policy Discovery

      Attempt to access detailed information about the password policy used within an enterprise network.

      discovery

    • Remote Services: SMB/Windows Admin Shares

      Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

      lateral_movement
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

2
T1569

Service Execution

2
T1569.002

Persistence

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

3
T1543

Windows Service

3
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hijack Execution Flow

1
T1574

Executable Installer File Permissions Weakness

1
T1574.005

Impair Defenses

3
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

Password Policy Discovery

1
T1201

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Remote Services

2
T1021

Remote Desktop Protocol

1
T1021.001

SMB/Windows Admin Shares

1
T1021.002

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Service Stop

2
T1489

Tasks