8fbdd18a277a827a911b2cd2ad1e891fc9957a3f3dc389b56ad2e00de0aaebfe | Triage™

Login
Reports

Overview

overview

Static

static

1

41dd27ce_.bat

windows10-2004-x64

41dd27ce_.bat

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
41dd27ce_.bat
Size 602B
Sample260625-lvv82aax2w
SHA256 8fbdd18a277a827a911b2cd2ad1e891fc9957a3f3dc389b56ad2e00de0aaebfe
MD5 4170dc45968b5ccf0e4a8d0ed1baf22e
SHA1 97b27af4b2d7c3810934addeb861f7d38a1b6d5f
SHA512 5d2a2740fb977465d735b08b44ed1d9e34a202e27e0ba0c65e15356aa94e7d192303e4dd97d7463bc6473feadc848e7607a8258fa1091d3d021558493c25de0c
TLSH
T1F8F0AC1228478731D590B5C0C85E4A43F3ABC69B68707BA4309270B87979494C6767EE
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion evasion execution impact persistence ransomware

Static task

static1

Behavioral task

behavioral1

Sample

41dd27ce_.bat

Resource

win10v2004-20260513-en

windows10-2004-x64

10 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware

Behavioral task

behavioral2

Sample

41dd27ce_.bat

Resource

win11ltsc2024-20260617-en

windows11-ltsc_2024-x64

12 signatures

150 seconds

defense_evasion evasion execution impact persistence ransomware

Malware Config

Targets

- Target
  41dd27ce_.bat
- Size 602B
- SHA256 8fbdd18a277a827a911b2cd2ad1e891fc9957a3f3dc389b56ad2e00de0aaebfe
- MD5 4170dc45968b5ccf0e4a8d0ed1baf22e
- SHA1 97b27af4b2d7c3810934addeb861f7d38a1b6d5f
- SHA512 5d2a2740fb977465d735b08b44ed1d9e34a202e27e0ba0c65e15356aa94e7d192303e4dd97d7463bc6473feadc848e7607a8258fa1091d3d021558493c25de0c
- TLSH
  T1F8F0AC1228478731D590B5C0C85E4A43F3ABC69B68707BA4309270B87979494C6767EE
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion evasion execution impact persistence ransomware
- Modifies WinLogon for persistence
  persistence
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Winlogon Helper DLL

Defense Evasion

Direct Volume Access

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasionevasionexecutionimpactpersistenceransomware

behavioral2

defense_evasionevasionexecutionimpactpersistenceransomware

© 2018-2026

Terms | Privacy