Extracted

• • Target

    s32del.bat

  • Size

    3KB

  • MD5

    1ebabf927d8616982c979628ac5f64ea

  • SHA1

    838adaaea597327c2dbbdd35fcbce782d7465bc8

  • SHA256

    3817241b23609388852915df16050a19f143d8b40544aadd39d140c6ac7b106a

  • SHA512

    4f6ceaf776aebf6f747c13088231c2618eee93495dc05ed58222028335fee9364dd529180c4490b56eb29f871867f42b0383c74eafa538e385d0981d006f425c

  Score

  10^/10

  discoveryevasionexecutionexploitpersistenceransomwaretrojan

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Possible privilege escalation attempt

    exploit

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1