Extracted

• • Target
    TextFile.bat
  • Size 4KB
  • SHA256 abb376627240b08ab5dc57562e376e6938780872c78412daa4b0b2734725c878
  • MD5 9b97bef5a524fc62ecc3d8932fff8244
  • SHA1 41cc6f00f637ab2a0bcd430bb7ee5159ad7e8d21
  • SHA512 35f6f7f7ca387b581a5897a05c0316edbc402aa17499091ce0f4e0c563ad2248259a9f30be02f2e4fccc5f1b3a5952fa8e54bf68738902a7e4245a064fd5c442
  • SSDEEP 96:j8/f+ExvfKjefJc59drzzTkAq12iPq3ymRoDoYrzOs11sXwOn96U:jufVaMc59drzhq12iPq3ymRoDow6s3sN
  • TLSH
    T1C59165141B585E10054E8D33F8BAAE53975C908BD1E0359BB0D9B0D49E392ACDFAFBD4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionadwarepersistenceransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2