ae4377aad3e4c4837705753c4d45d704bb4db0c17375941a650f306f82783137 | Triage™

Login
Reports

Overview

overview

Static

static

1

ядерка1.bat

windows10-ltsc_2021-x64

Sharing

Copy URL Twitter E-mail

General

Target
ядерка1.bat
Size 3KB
Sample260625-mtd4ssbs2p
SHA256 ae4377aad3e4c4837705753c4d45d704bb4db0c17375941a650f306f82783137
MD5 8600624143e47c1320f54d079591b4b7
SHA1 61626a43e776bb498941908514548d56239ab95a
SHA512 af792a567e04e517777fb31707f49f5d501da2f627e40103285e2ac0ed713f574dc90f523ce831d39827920a242914f6218709223ef9bbca086b6f51fec0889d
TLSH
T13051DD202E028267A691A130D84F6803F7BAE28B2C14EF6075577095687F185DEBC6DA
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan

Static task

static1

Behavioral task

behavioral1

Sample

ядерка1.bat

Resource

win10ltsc2021-20260513-en

windows10-ltsc_2021-x64

17 signatures

150 seconds

defense_evasion discovery evasion execution impact persistence ransomware trojan

Malware Config

Targets

- Target
  ядерка1.bat
- Size 3KB
- SHA256 ae4377aad3e4c4837705753c4d45d704bb4db0c17375941a650f306f82783137
- MD5 8600624143e47c1320f54d079591b4b7
- SHA1 61626a43e776bb498941908514548d56239ab95a
- SHA512 af792a567e04e517777fb31707f49f5d501da2f627e40103285e2ac0ed713f574dc90f523ce831d39827920a242914f6218709223ef9bbca086b6f51fec0889d
- TLSH
  T13051DD202E028267A691A130D84F6803F7BAE28B2C14EF6075577095687F185DEBC6DA
- MD5 SHA1 SHA512 TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware trojan
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Adds Run key to start application
  persistence
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Power Settings

Privilege Escalation

Abuse Elevation Control Mechanism

Bypass User Account Control

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Create or Modify System Process

Windows Service

Event Triggered Execution

Change Default File Association

Defense Evasion

Abuse Elevation Control Mechanism

Bypass User Account Control

Direct Volume Access

File and Directory Permissions Modification

Impair Defenses

Disable or Modify Tools

Indicator Removal

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasiondiscoveryevasionexecutionimpactpersistenceransomwaretrojan

© 2018-2026

Terms | Privacy