4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6

General

Target
Filesecurity.bat
Size 24KB
Sample260419-stsj3sa13z
SHA256 4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6
MD5 a746ba56096a56b3a78ed5c2c7c840db
SHA1 5383c7a51d94c4c5d1abf86b434b542f4d3d58c6
SHA512 77c045e977fb91c0ce4d9fbc5ba4d97fc35bd35cc8041e13ac2eb8bafeb29d3f94318e312e52b4968dc6330e0aac937e67444185c855df960e747a559534f812
SSDEEP 384:GrDYO/DMdq9Lh2zPEg1r8j/vBHQIiSgjGir+FZj0y4B0JgHczXl+9QNNoHvyHWmh:GIyj/3tFwaadA1AxbtEDdzJ
TLSH
T160B2A52239149D7BD091F360AC9B5801B7A6A1C760427FC0B6DF70A463779CA973CADE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Filesecurity.bat
- Size 24KB
- SHA256 4997de08553a689944ab250ef4611ac829167ed958b24f0e3f778a74577eb2c6
- MD5 a746ba56096a56b3a78ed5c2c7c840db
- SHA1 5383c7a51d94c4c5d1abf86b434b542f4d3d58c6
- SHA512 77c045e977fb91c0ce4d9fbc5ba4d97fc35bd35cc8041e13ac2eb8bafeb29d3f94318e312e52b4968dc6330e0aac937e67444185c855df960e747a559534f812
- SSDEEP 384:GrDYO/DMdq9Lh2zPEg1r8j/vBHQIiSgjGir+FZj0y4B0JgHczXl+9QNNoHvyHWmh:GIyj/3tFwaadA1AxbtEDdzJ
- TLSH
  T160B2A52239149D7BD091F360AC9B5801B7A6A1C760427FC0B6DF70A463779CA973CADE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware spyware stealer trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Disables Task Manager via registry modification
  defense_evasion
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Creates new service(s)
  persistence execution
- Disables service(s)
  defense_evasion execution
- Drops startup file
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Stops running service(s)
  defense_evasion execution
- Adds Run key to start application
  persistence
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2