a1295cbeef51dfd7bba79d6aee5706ae0f0c9ad04daecfdecb75001dec161877 | Triage

Sharing

General

Target

test.bat
Size

622B
Sample

250330-x2891sxnt5
MD5

f4e2c9d54a8bd93fd71e7106461f2644
SHA1

5afcafdf60a6deae85142bfe4422497b8c5f7928
SHA256

a1295cbeef51dfd7bba79d6aee5706ae0f0c9ad04daecfdecb75001dec161877
SHA512

74a5307a3a0fc17a523ae0d452cd5bcfb7093eb632d806a8fadf033ac4464aa948a268ebd73c5869fa22562bf510a89636255df98991d980e52d39b21e49b338

Score

8^/10

execution ransomware

Malware Config

Targets

- Target
  
  test.bat
- Size
  
  622B
- MD5
  
  f4e2c9d54a8bd93fd71e7106461f2644
- SHA1
  
  5afcafdf60a6deae85142bfe4422497b8c5f7928
- SHA256
  
  a1295cbeef51dfd7bba79d6aee5706ae0f0c9ad04daecfdecb75001dec161877
- SHA512
  
  74a5307a3a0fc17a523ae0d452cd5bcfb7093eb632d806a8fadf033ac4464aa948a268ebd73c5869fa22562bf510a89636255df98991d980e52d39b21e49b338
Score

8^/10

execution ransomware
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

executionransomware