3ce5c434e7ab8a3d652cdb5f7b4f6f6c1be695225ed2e3f9dcb0718e74784630

General

Target
File security.bat
Size 24KB
Sample260419-mdjpcaf17n
SHA256 3ce5c434e7ab8a3d652cdb5f7b4f6f6c1be695225ed2e3f9dcb0718e74784630
MD5 4e4d4593b9aa85ccf2bfa3499c746de6
SHA1 524049752697477f9c1c111af76ab39530af3bfa
SHA512 69fd9a3f1ebebc487fb40ab07aaae27f8e59b03028abf61c2b0c326eeff7f3a86ab590602bfdce417becd6cff1d2dab96b3cb67acf68f1f58bb9f44e67a39748
SSDEEP 384:GrDYO/DMdq9Lh2zPEyze91r8j/vBTQIiSgjGir+FZj0y4B0JgHczXlWhW+9QNNok:GIpj/7tpwaadAgAGbtEDdzj
TLSH
T131B2A52239159D3BD191F260AC9B5801B7B6A1C760427FC0B6DF70A46377AC9933CADE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  File security.bat
- Size 24KB
- SHA256 3ce5c434e7ab8a3d652cdb5f7b4f6f6c1be695225ed2e3f9dcb0718e74784630
- MD5 4e4d4593b9aa85ccf2bfa3499c746de6
- SHA1 524049752697477f9c1c111af76ab39530af3bfa
- SHA512 69fd9a3f1ebebc487fb40ab07aaae27f8e59b03028abf61c2b0c326eeff7f3a86ab590602bfdce417becd6cff1d2dab96b3cb67acf68f1f58bb9f44e67a39748
- SSDEEP 384:GrDYO/DMdq9Lh2zPEyze91r8j/vBTQIiSgjGir+FZj0y4B0JgHczXlWhW+9QNNok:GIpj/7tpwaadAgAGbtEDdzj
- TLSH
  T131B2A52239159D3BD191F260AC9B5801B7B6A1C760427FC0B6DF70A46377AC9933CADE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Creates new service(s)
  persistence execution
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1