General
- Target dene.bat
- Size 205KB
- Sample260703-kzvbvset4v
- SHA256 97ccd46008012e261bb783d4787b0998f03703053a35540f82f6cb8dab5c2e65
Score
9/10
Malware Config
Targets
-
- Target dene.bat
- Size 205KB
- SHA256 97ccd46008012e261bb783d4787b0998f03703053a35540f82f6cb8dab5c2e65
Score9/10-
Modifies boot configuration data using bcdedit
-
Event Triggered Execution: Image File Execution Options Injection
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Indicator Removal: Clear Persistence
remove IFEO.
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Power Settings
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
-
Remote Services: SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Power Settings
1Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Indicator Removal
2Clear Persistence
1File Deletion
1