049074d8095e81e80606ccf94e395b14f15c026776ac020fe507b54971bb3c5b

General

Target
HYPER TWEAKS.bat
Size 160KB
Sample260620-lgflesd19j
SHA256 049074d8095e81e80606ccf94e395b14f15c026776ac020fe507b54971bb3c5b
MD5 45030d1e2b512a071913a6d17fe3af4f
SHA1 506d7c42b34cdef1609d61aac4647bdf058bd36d
SHA512 4db0ede41f9193963c12521857a7f0063b71f09300c33d92abddc3e17753392cfa4d07645f06199934cd508483482e0cd777a9ad3969ebdbd0e729fc37237745
SSDEEP 1536:AsoZyt+bDdoymgn080iSMT/SxAzKsnxUa:Vozd/SQnma
TLSH
T125F3EF267D2203B2C0D5AD26EE3ADC52573A71C3D8B1876079EE60E90FB7406CD3A5E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  HYPER TWEAKS.bat
- Size 160KB
- SHA256 049074d8095e81e80606ccf94e395b14f15c026776ac020fe507b54971bb3c5b
- MD5 45030d1e2b512a071913a6d17fe3af4f
- SHA1 506d7c42b34cdef1609d61aac4647bdf058bd36d
- SHA512 4db0ede41f9193963c12521857a7f0063b71f09300c33d92abddc3e17753392cfa4d07645f06199934cd508483482e0cd777a9ad3969ebdbd0e729fc37237745
- SSDEEP 1536:AsoZyt+bDdoymgn080iSMT/SxAzKsnxUa:Vozd/SQnma
- TLSH
  T125F3EF267D2203B2C0D5AD26EE3ADC52573A71C3D8B1876079EE60E90FB7406CD3A5E5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

adware defense_evasion discovery evasion execution persistence ransomware spyware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Indicator Removal: Clear Persistence
  remove IFEO.
  defense_evasion
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
- Modifies Security services
  Modifies the startup behavior of a security service.
  defense_evasion
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1