Extracted

Extracted

• • Target
    UploadThisFile.bat
  • Size 8KB
  • SHA256 5abbf3bc75f08e11e7ab7c6993311f2e37101ed83a32579b59a826df1549b83a
  • MD5 ba8bfbacc3552992b38cb6e97b70365b
  • SHA1 6b60f1fe9abe30d4b01c8d52457177b4c8e46910
  • SHA512 0b428756e48f24c54b500f6549ce7709a93961f367e7ce4e327a8078298311c3ab1ebf26c57bcdb92140c8f0d7cef28d9a2d3345f4402709868747abe128c9e4
  • SSDEEP 96:8zzzqz5oz0z8zHzRz8zKzXzlzAzFtCA8uB+TiF0YppJRKZe9ccJnKYb6Xn9RSRM0:4SA5RjVwH
  • TLSH
    T140021130A52BA167E772FA10D58F5A437B3B72876450878336BB242B44E3947C13DADB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionpersistenceprivilege_escalationtrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Hijack Execution Flow: Executable Installer File Permissions Weakness

    Possible Turn off User Account Control's privilege elevation for standard users.

    defense_evasionpersistenceprivilege_escalation

  • Modifies Security services

    Modifies the startup behavior of a security service.

    defense_evasion
  behavioral1behavioral2