Extracted

• • Target
    synch-tool.bat
  • Size 1KB
  • SHA256 a586feb9ef248c61911bea5382b72b5e859dfa2f46c4e8e49016a37abeab16e7
  • MD5 4c41b7246fdf945a54a66bfd1800a548
  • SHA1 1129ce2b51f88c0b70daa7402a064a6e24d168f3
  • SHA512 f94f54af75bc7d8d0870c8c233e23ee7fb6d6eacd85dbda2b31a9d5a6d901545eaf69a27bea52e9c5a68b032d7fc4e0e5a5bc1e375f571589de0a973aeebb29f
  • TLSH
    T1D921E79BB31EE08292F0A5E68DBC0062B55E45C7D9053C8A72579070120A3D2BBDA8CD
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasionexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  behavioral1behavioral2