Extracted

• • Target
    tst.bat
  • Size 877B
  • SHA256 f57ad5dd18d5796c29ecf822ff517fd7f10d8d912f56ac2d8ea47756d67fdc2f
  • MD5 b310c3ca99112f579ab9cf9aa2ab9f55
  • SHA1 1e321a5c57ebac18950b7bc2224106550251bbfa
  • SHA512 b7218ce5f3c2c9faceef490c0302e001e7b2cf1e17d4dca333916e28c3f6aec382c26f2d67f5e2d3eca7ff8de87e4a6c3d6b28c47fc4e65d19e9ef70f39b0c00
  • TLSH
    T10A112F35C22ECF78862ECC33AC731E77CD8891968846185237D4E94DE5AA238C2012D7
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistencepyinstaller

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • System Binary Proxy Execution: Rundll32

    Abuse Rundll32 to proxy execution of malicious code.

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1