cd80f0dccf9206abf0e0728e5d8eb981ba3fee99324d7ebc59dd668814207de7 | Triage™

Login
Reports

Overview

overview

Static

static

1

4786cf49_.bat

windows10-2004-x64

4786cf49_.bat

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
4786cf49_.bat
Size 498B
Sample260624-2bh3csf12y
SHA256 cd80f0dccf9206abf0e0728e5d8eb981ba3fee99324d7ebc59dd668814207de7
MD5 faa620c6d1bb1e2a5b69a1f567ce3d42
SHA1 70a7ba81231fa9e24ed13598de02f049972c4a5e
SHA512 62d968b5f3a265453a9b94c1dae12b9d8216ca4e0e6e5fded55ea4c6aa8bf54a5706f513d00e00457abc4de356b9686b789ceb6d1541953d28b7e79278f334a2
TLSH
T187F00E12344A8731EAA0B940C80E8D43B3BBC78B6830BFE43082A088A93D480C0753DA
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware

Static task

static1

Behavioral task

behavioral1

Sample

4786cf49_.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware

Behavioral task

behavioral2

Sample

4786cf49_.bat

Resource

win11ltsc2024-20260618-en

windows11-ltsc_2024-x64

10 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware

Malware Config

Targets

- Target
  4786cf49_.bat
- Size 498B
- SHA256 cd80f0dccf9206abf0e0728e5d8eb981ba3fee99324d7ebc59dd668814207de7
- MD5 faa620c6d1bb1e2a5b69a1f567ce3d42
- SHA1 70a7ba81231fa9e24ed13598de02f049972c4a5e
- SHA512 62d968b5f3a265453a9b94c1dae12b9d8216ca4e0e6e5fded55ea4c6aa8bf54a5706f513d00e00457abc4de356b9686b789ceb6d1541953d28b7e79278f334a2
- TLSH
  T187F00E12344A8731EAA0B940C80E8D43B3BBC78B6830BFE43082A088A93D480C0753DA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion evasion execution impact persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceransomware

behavioral2

defense_evasionevasionexecutionimpactpersistenceransomware

© 2018-2026

Terms | Privacy