Extracted

• • Target
    FotosDaFormatura.bat
  • Size 1KB
  • SHA256 6aae6365dd4ff712994562ae8356e0562d3f411675546f12d0d76aee668f6ecf
  • MD5 b11e615609c58750261f36dae971e9ef
  • SHA1 8d61278ad39dc37a965c318890247497f447f836
  • SHA512 57befbe1252254180072112745d025c33d0c2ab27cd19dd3a9ff81c4c0714eb653789b88425ff0f3b6647547e10ba70345ba9f6d7fbd217d1c91c1c4612a45f5
  • TLSH
    T1613198297786D0D62C520536CCE3B459B578E286450D9D58B0EE40D45F1F8D8B1B9C1A
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2