fc2203355b77a210eeb23b3316a14edc99b2e488bae1bada98d377311a85e526

General

Target
chwat_obfuscated.bat
Size 8KB
Sample260723-rdm4zsbd26
SHA256 fc2203355b77a210eeb23b3316a14edc99b2e488bae1bada98d377311a85e526
MD5 e8f11b51283b33678198526833771915
SHA1 308eefa077a3db156d285334d6d06f3021a63eda
SHA512 a72bf70a1024e72ba6c6f04bed86acad0095047330bb9c3f8fb4d5e2fbb5b3b1a6ee7bc052add4844f6b404211031f4a198e7f9f7805e57405d4ea524cb9fa87
SSDEEP 192:j0asaJc5TR3799VA2+soDQ/i1OYTFSSwG0RLArIDstZzeDCtdXDWWqRcy/97qI2w:j0rN5TR37Rx+soDQ/i1OYTFSSwG0R8MR
TLSH
T19012A6133A188C6DC1A6905088F7940163A1918F3651FFD8B6ECE280FB363A947B7ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  chwat_obfuscated.bat
- Size 8KB
- SHA256 fc2203355b77a210eeb23b3316a14edc99b2e488bae1bada98d377311a85e526
- MD5 e8f11b51283b33678198526833771915
- SHA1 308eefa077a3db156d285334d6d06f3021a63eda
- SHA512 a72bf70a1024e72ba6c6f04bed86acad0095047330bb9c3f8fb4d5e2fbb5b3b1a6ee7bc052add4844f6b404211031f4a198e7f9f7805e57405d4ea524cb9fa87
- SSDEEP 192:j0asaJc5TR3799VA2+soDQ/i1OYTFSSwG0RLArIDstZzeDCtdXDWWqRcy/97qI2w:j0rN5TR37Rx+soDQ/i1OYTFSSwG0R8MR
- TLSH
  T19012A6133A188C6DC1A6905088F7940163A1918F3651FFD8B6ECE280FB363A947B7ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution exploit impact persistence privilege_escalation ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- UAC bypass
  defense_evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Disables Task Manager via registry modification
  defense_evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
- Modifies Windows Firewall
  defense_evasion
- Possible privilege escalation attempt
  exploit
- Disables service(s)
  defense_evasion execution
- Executes dropped EXE
- Modifies file permissions
  discovery
- Stops running service(s)
  defense_evasion execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification
  defense_evasion
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
- Sets desktop wallpaper using registry
  ransomware
behavioral1 behavioral2 behavioral3 behavioral4