Overview

overview

8

Static

static

1

privacy-script.bat

windows10-2004-x64

8

privacy-script.bat

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    privacy-script.bat
  • Size 850KB
  • Sample260703-pphbrsd16k
  • SHA256 2fbb4b8dc1aac8aa951c98fe274a745edcf112d0ddcac0f42736a89a4228fc94
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploitpersistenceransomware

Malware Config

Targets

    • Target
      privacy-script.bat
    • Size 850KB
    • SHA256 2fbb4b8dc1aac8aa951c98fe274a745edcf112d0ddcac0f42736a89a4228fc94
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionexploitpersistenceransomware

    • Drops file in Drivers directory

    • Indicator Removal: Network Share Connection Removal

      Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

      defense_evasion

    • Possible privilege escalation attempt

      exploit

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies file permissions

      discovery

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

      defense_evasion

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

2
T1222

Windows File and Directory Permissions Modification

1
T1222.001

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Indicator Removal

2
T1070

File Deletion

1
T1070.004

Network Share Connection Removal

1
T1070.005

Modify Registry

1
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks