Extracted

Extracted

• • Target
    BATPackageBulderSetup.bat
  • Size 1KB
  • SHA256 de4f51649ec1a33071854aefe93ffb3fc225e19f802d8dd914676dd5dfef2615
  • MD5 9bfacce695de7b046d2af27385bb778e
  • SHA1 4f894e48a61ce53884f41dec6e1665d556cee4c6
  • SHA512 8bf08437961fee840227023114a09821532b678d2cb6de91d830383e1409a87043da5f67b156fe3c94a45716a18a87fc7511f4e507514a6895a7032eb69bfb23
  • TLSH
    T1801102077AB7EAA485921F558BBA5411F81112C74B081E4AF0EB816A73053C7F3FCECA
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionadwarepersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Start PowerShell.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery
  behavioral1behavioral2