General
- Target 30072026_1329_Documento-999333.bat.zip
- Size 2KB
- Sample260730-qrh7hsyelf
- SHA256 75381ebc8dba61058695af7ff7e08a774c5719f0bc3c91b5e84d51c3f76dcea3
Score
8/10
Malware Config
Targets
-
- Target Documento-999333.bat
- Size 5KB
- SHA256 b76ec225001c819ef11bcb2bea16f5960c1f8477ab3f2e2f2136631b5cd15825
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Network Share Discovery
Attempt to gather information on host network.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Defense Evasion
File and Directory Permissions Modification
1Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
1Obfuscated Files or Information
1Command Obfuscation
1Subvert Trust Controls
1Install Root Certificate
1