Extracted

• • Target
    run.bat
  • Size 1KB
  • SHA256 14029860a29139be82df790bed79d62f2167cade4bc5787946449a3e614ed20c
  • MD5 f479791ed6dee946fb36b36ab9aa38d2
  • SHA1 8c177d65568cf1dcd69b74c17b95f17ecc18870b
  • SHA512 df5b200b65f931eef7c4e56edd5326e56fff8811ec0f650fac09e0d7e3f415b7fcb65d06681943636e2fea7c6a66fde502735fda71e0f090801a0e41003ba094
  • TLSH
    T1C9216853A60903650A57CCF6C0255B6CE85FA261D614ECD677B08084754A3DD87F0ACC
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1