General
-
Target
HmUnban.Bat
-
Size
2KB
-
Sample
230417-skqn5agd3s
-
MD5
1719d598ec3f8e8439a0da90ff9baa9d
-
SHA1
14e4e92dcf6cf251b1d6896120bedf54dc37e39d
-
SHA256
df6962bda69e8939ffe4c4dafd96757a45a6ed308ee6b153304658385a9d19e8
-
SHA512
e9d4c613e0b17776c76b911c998cd428cf255a78d196a511f40fe287b15b99ac6ae60251278678789b9d28bde05cb98c8aaa4f602262ddc29fec4f5dd30aef54
Static task
static1
Behavioral task
behavioral1
Sample
HmUnban.bat
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
HmUnban.bat
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
HmUnban.Bat
-
Size
2KB
-
MD5
1719d598ec3f8e8439a0da90ff9baa9d
-
SHA1
14e4e92dcf6cf251b1d6896120bedf54dc37e39d
-
SHA256
df6962bda69e8939ffe4c4dafd96757a45a6ed308ee6b153304658385a9d19e8
-
SHA512
e9d4c613e0b17776c76b911c998cd428cf255a78d196a511f40fe287b15b99ac6ae60251278678789b9d28bde05cb98c8aaa4f602262ddc29fec4f5dd30aef54
Score8/10-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies system executable filetype association
-
Registers COM server for autorun
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-