General
- Target winPEAS.bat
- Size 38KB
- Sample260321-a51eysfy6q
- SHA256 ea1a2d01e622dfaae4fee2b353bab7912c2fb2235aa05bea0863f2f4cb829b33
- MD5 eeb43a531026c27753188ab562cf2271
- SHA1 93592c884c37edb1c520ef0b570b4c1fe57a6e34
- SHA512 f594bead6d1754846759f87d349b58c2a4cb0393cdd2b85375ec6f82f08de22d948ff39bcd76da586b9d1bcbd1f6a2ed1357f2a94ccecb895d049296b782d67f
- SSDEEP 768:THw3hDBRQ6u54v8Vg7EkRVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5ITOx1Zoh:7w3hDBRRu54v8i7TRVlB1Zmw6CMUM4Lp
- TLSH T10D03C68635141C1843F6E7B7AA414B80137311B72D176ACE3ADDA9BD9B2E1EE1B710CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
winPEAS.bat
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
winPEAS.bat
Resource
win11-20260130-en
Malware Config
Targets
-
- Target winPEAS.bat
- Size 38KB
- SHA256 ea1a2d01e622dfaae4fee2b353bab7912c2fb2235aa05bea0863f2f4cb829b33
- MD5 eeb43a531026c27753188ab562cf2271
- SHA1 93592c884c37edb1c520ef0b570b4c1fe57a6e34
- SHA512 f594bead6d1754846759f87d349b58c2a4cb0393cdd2b85375ec6f82f08de22d948ff39bcd76da586b9d1bcbd1f6a2ed1357f2a94ccecb895d049296b782d67f
- SSDEEP 768:THw3hDBRQ6u54v8Vg7EkRVlB1Zmw6CMUM4LvfnCMOaHLhqghCPzr0Ih5ITOx1Zoh:7w3hDBRRu54v8i7TRVlB1Zmw6CMUM4Lp
- TLSH T10D03C68635141C1843F6E7B7AA414B80137311B72D176ACE3ADDA9BD9B2E1EE1B710CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Grants admin privileges
Uses net.exe to modify the user's privileges.
Modifies Windows Firewall
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Modifies file permissions
Enumerates processes with tasklist
MITRE ATT&CK Enterprise v16
Persistence
Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Access Token Manipulation
1Create Process with Token
1Account Manipulation
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Access Token Manipulation
1Create Process with Token
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Network Service Discovery
1Network Share Discovery
1Permission Groups Discovery
1Local Groups
1Process Discovery
1Query Registry
1System Information Discovery
2System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Network Connections Discovery
1