General
- Target Ratty Patty.bat
- Size 12KB
- Sample260729-cpqlxser2y
- SHA256 78e66a40e243859baa61beb509839af5befe7763a2039a97d219f8835e88c3d0
Malware Config
Targets
-
- Target Ratty Patty.bat
- Size 12KB
- SHA256 78e66a40e243859baa61beb509839af5befe7763a2039a97d219f8835e88c3d0
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Command and Scripting Interpreter: PowerShell
Powershell Invoke Web Request.
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1