700aa876e0e24987f80ee483fdea80c346ce65f3e68b7de51512da4266bd17f9

Sharing

Copy URL Twitter E-mail

General

Target
enhanced-command-prompt-portable-main.zip
Size 110KB
Sample260811-b3zlbashja
SHA256 700aa876e0e24987f80ee483fdea80c346ce65f3e68b7de51512da4266bd17f9
MD5 a304a5ddb5ccec80fea311ae0de60488
SHA1 99031d915bf4262053847f137d1ac9b41907db0f
SHA512 8bb1853477c4132909fe972b34e87321958a675c6cbfb621ceed7792da8ddc9f2abdc77751b4a33aea14afce6bab2fe6c089e49a6b7e303c806d0cfc6b3db1ef
SSDEEP 1536:DQxgw/r00JQU0Uo7jZ9NV6jYWda75J1fDyctAOryY6R1H1K/gVZNuB/cpLlQFshy:8mwj04QUpGVgELxyc+ro/IE/yBumK3
TLSH
T18AB3E165D3EABC64D39C40BE5E2D180B82C47683D7709AD701BBB8608F4D15B658B7DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  enhanced-command-prompt-portable-main/App/DefaultData/Batch/commandprompt.bat
- Size 78B
- SHA256 40065dc19e84a59c7a26ab14e412f8fc16439b88cc6c97df7acc679878e5266b
- MD5 9fdfad6f000ee390260c4e2eee5984bc
- SHA1 bca30037c5928262fb8171c8ea0ef07894c7db23
- SHA512 d1c61fdf76befd67a519c764a1a498c621163f397c268e3b44ff03aa091b9dece1f90c3a0abf91fa15727c0892d1bcaf4447ac3a73d4815910f7a35941bdc499
- TLSH
  T179A0123289594486001DC41001AC64CC12D4189253511264300E9024C080A46E0060F0
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  enhanced-command-prompt-portable-main/CommandPromptPortable.exe
- Size 73KB
- SHA256 612931cfd285f8bde76e3d88e676639cdf3b9fb8ca31d26ce6216b141ca62e3a
- MD5 3bd1d7f35758354d153abb929f779f6e
- SHA1 dea3dc1286162fe35983d312eccad2ee51f5bab3
- SHA512 5d764181e400cdf19d57a6ceef0b2ded37c90be8ebe7fdb76fdd25e60be588060d922fcdd4de9fc84bb63e9b765d92f10217f717c6203b7dbc036d10e70082d0
- SSDEEP 1536:0nQpQ5EP0ijnRTXJU8IkkFxxFps8u4qfpIHqy:2QIURTXJfIVVpwl7y
- TLSH
  T1C573CF9673D9C867F6534E70047AE33EEAB2FE001A666277AF643FEA79703421905143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery execution defense_evasion exploit
- Possible privilege escalation attempt
  exploit
- Loads dropped DLL
- Modifies file permissions
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
- MD5 00a0194c20ee912257df53bfe258ee4a
- SHA1 d7b4e319bc5119024690dc8230b9cc919b1b86b2
- SHA512 3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH
  T113325B5993A0C1F3D5A0823C0DA73A7B1379722016B14FA3CFA35841AE196D7AC7D237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/registry.dll
- Size 16KB
- SHA256 b610ab13da00e05b000026c73081cfdf0d2ebd3f2fad05e1d0f277060fc3c07f
- MD5 351f89337642c165a48dd763aa210023
- SHA1 a5b204cbc51a0ad84248aa680b85be7824f3354e
- SHA512 10326b95ea81b377f74cb9e42135e891930a354b65ce50a4562246da33ca6816f5397089bb60cd1eb647bd28829d70f6425c3113440e11f9a9a4f7fecaac7f4c
- SSDEEP 384:tTVUUuJHxgeh2OTU+X9pCtlohiTV0pWY7:tTqzHxgeh5X9oaiTgW
- TLSH
  T15C72198ACF9098B1D0DB2839B5931E1F596BEC74251938A3A1C72CC0496C6A7737F762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  enhanced-command-prompt-portable-main/Data/Batch/commandprompt.bat
- Size 7KB
- SHA256 78d10dd389087a2b3da7146fe754994d928d520dafb993e6bc6f4a7d5da5438e
- MD5 111175a65ebf2fa598227e927df133a6
- SHA1 fff29cb7b6a377d56dbde2379af29f88ad1193cb
- SHA512 42dd7c2cb30429de914d9cca1c6e145215ac24d197341c5cf53f69d617835d8bb10ae4ea57a4209fd97ff61a4ddfafd548f20f1f03cfbf2d81cdbc07dfb6eebe
- SSDEEP 192:L3DBm3w3Q3u3A9VrFEjlepq5OmS82PB2yjr:HldLOP8w
- TLSH
  T15CE1D62215DA6D2A04B8B2773F0B16EE538BC164E6AD551E306F3E4C234CADD4C7A6DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral10 behavioral9
- Target
  enhanced-command-prompt-portable-main/Data/Batch/dirc.bat
- Size 7KB
- SHA256 e64602f9927148e8448dcee327b623c4786aaafdd1c7b1ca7bbb5a09101d5c38
- MD5 09c4ba21ba85863ed6a10a9f166742e3
- SHA1 8d76ca306011db0525d00a77bf83f2d701d6ba1a
- SHA512 1a22eeca0405e5f3bf51d9421650c496cf696c9d63ef09edfb95b4415230a82d954fdd9dcdde446a8c88e42b83c842e7ebe9e3740e580d79ae0bb3be61717893
- SSDEEP 192:Fgg3C207Gfim/RY5razSSyxRD4Wun5D84x1/:2H1razSrG54q/
- TLSH
  T1B5E1931231060E2A14B17632BF2B55EED31DC3D2D2D8AAAC79AD3EC4230D9E454B78DC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral11 behavioral12
- Target
  enhanced-command-prompt-portable-main/Data/Batch/listc.bat
- Size 7KB
- SHA256 04d0d873b66339ad614aa611f81d759a75b41d253c12a28d83a29400b6212ca5
- MD5 a22b320c2ac9277af99e4cc69f0cff48
- SHA1 619e336ac510989e50be598d7dc478c084610a68
- SHA512 bc6a30f854ae486974b53cb3490d41e33804b6dae9f4d6a817fabb49690d5fb205e777caae470849bd3c2ee3017e7a61c3cb2a5e62776ea1d6e9e82ed6646368
- SSDEEP 192:igr3BijGf7C4GHo46DWwWQJAISrZRD6stDPLcpDAxX:TjC3cWoJiZRfte8X
- TLSH
  T12EF1641120420D1A14B17373BF6B55FCF71DD3A2C268A66C78AC7E5C630E9D8A8769EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14
- Target
  enhanced-command-prompt-portable-main/help.html
- Size 3KB
- SHA256 c017703a6502866aa3a6fe0f783191bbb5fd1c1f7f932ecde24ef19d2f4f2116
- MD5 0eb289a2d1b9a8b9130cb4d0a0cad8e3
- SHA1 16365a117fa94b921c439780d317184d686ffa63
- SHA512 3572193c5ac040286cd17d1a8a8ea3303e8f5e4e5417dddfa7cf252de93c83d99a4eada29b8dfb81bd97b37d9e66b9d390231dfa7a49cb6b9c8b16419411e4f3
- TLSH
  T12071913F2B10780F2241E0B5BB4ABFA4760E95069F2E0E71B8B0B82DD6804B2013279D
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral15 behavioral16

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Possible privilege escalation attempt

Loads dropped DLL

Modifies file permissions

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16