Clearing Traces on Windows with a BAT Program

Environment

Related Script

Clearing Traces

• During an intrusion, an attacker may create or drop malware on a computer. During one attack by the apt group Kimsuky against South Korea's defense industry, the group dropped a bat script in a temporary directory to make the sample and the bat delete themselves.

• This simulated attack left two files, sample.exe and del.bat. We use a bat command to delete the remaining files.

del "E:\TempProjects\del_self\sample.exe"
del "E:\TempProjects\del_self\del.bat"

• The commands execute successfully and delete the sample.exe and del.bat files.

• The BAT script is as follows:

:del_start
rd /s /q "E:\TempProjects\del_self\sample.exe"
del "E:\TempProjects\del_self\sample.exe"
if exist "E:\TempProjects\del_self\sample.exe" goto del_start
del "E:\TempProjects\del_self\del.bat"

• The PowerShell script is as follows:

$bat_file_path = "E:\TempProjects\del_self\del.bat"
New-Item -Path "E:\TempProjects\del_self\" -Name "sample.txt"
Start-Process -FilePath $bat_file_path