General
- Target 09b33e73_.bat
- Size 1KB
- Sample260625-maek8aay3s
- SHA256 d76f5ba919698befdfd43347ecf152a26756d05f06f484338a6494d372247bbb
- MD5 c5e563c7efdd9c257898bff5a20f1d12
- SHA1 7f0024d354eb07bd590c7d7e30e090e6d334bc80
- SHA512 a78ef2bd32e324519f9ff8ed31e0c87559bd83fcb5e5b9d993c1944ce8ac14d9ef47f6f1ce91908b9a8917f4a9d1eb68a0f7823a22574f624a407b4e73fa14c1
- TLSH T1F231DF222913C622E662A4B0D50F5902F77FE2571C20AE60755330B8BD7E18AC6BD7DB
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
09b33e73_.bat
Resource
win10v2004-20260513-en
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
09b33e73_.bat
Resource
win11ltsc2024-20260618-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target 09b33e73_.bat
- Size 1KB
- SHA256 d76f5ba919698befdfd43347ecf152a26756d05f06f484338a6494d372247bbb
- MD5 c5e563c7efdd9c257898bff5a20f1d12
- SHA1 7f0024d354eb07bd590c7d7e30e090e6d334bc80
- SHA512 a78ef2bd32e324519f9ff8ed31e0c87559bd83fcb5e5b9d993c1944ce8ac14d9ef47f6f1ce91908b9a8917f4a9d1eb68a0f7823a22574f624a407b4e73fa14c1
- TLSH T1F231DF222913C622E662A4B0D50F5902F77FE2571C20AE60755330B8BD7E18AC6BD7DB
- MD5 SHA1 SHA512 TLSH
-
Modifies WinLogon for persistence
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Disables Task Manager via registry modification
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2