Extracted

• • Target
    Proposal_Agreement.bat
  • Size 3KB
  • SHA256 3c0c7c9356e0f1e0a0d2bc86b31ee8857b8e290a582e385c77dde651d297d5eb
  • MD5 c2566c544dc7474e950f8a3f2bae5689
  • SHA1 54206b6af2cd0c7dd05cdb2621fdca03ed010717
  • SHA512 86b8b2479748f0d32a81dd08fb50f214be02e4f2611aa5101ff05cb2cfe0db6027548f067ee4a3d4340cb39af7d1d4bb76269153d760b00be009cb9b278e2bdb
  • TLSH
    T1C371CE2DDE74FCD0037D7290C9692E9720D15B47DB760EB8DA0218EA2C28752DF2A39C
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  costuradefense_evasiondiscoveryexecutionpackerpersistenceprivilege_escalationspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2