General
- Target temp (1).BAT
- Size 17KB
- Sample260812-cer21aaa38
- SHA256 b24b70689dba447c9eb671d5917c61786b6cfd5de3f005f12caf71b846ab1645
- MD5 a33d004bfcfa942c8dd1d33bbcc5c94d
- SHA1 60fee2738310e3edfdc6f16343b96bbd26a0d77b
- SHA512 f15ffd3e2a7eed1db5714ce7ad299b97e9da2de5c96d1bf8c8cf6b0930e554b736cb832a1c0eb41efa0660ef0c3583c9709c0e6ae1e4b830071b33d525a49fa9
- SSDEEP 384:NBS3rWnuOHTcYpdJzTwhwgniPySr64PYA0NNL52dMEBffQGbggDBiMJuS8hLhuVw:Nq0TuS8hLhuVmiL3Uj
- TLSH T1DA82B537B4149827C57663B0D9AF2501B265D28B8E013FC1B8EFA0A5271B3D5937E9CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
temp (1).bat
Resource
win10v2004-20260513-en
35 signatures
150 seconds
Malware Config
Targets
-
- Target temp (1).BAT
- Size 17KB
- SHA256 b24b70689dba447c9eb671d5917c61786b6cfd5de3f005f12caf71b846ab1645
- MD5 a33d004bfcfa942c8dd1d33bbcc5c94d
- SHA1 60fee2738310e3edfdc6f16343b96bbd26a0d77b
- SHA512 f15ffd3e2a7eed1db5714ce7ad299b97e9da2de5c96d1bf8c8cf6b0930e554b736cb832a1c0eb41efa0660ef0c3583c9709c0e6ae1e4b830071b33d525a49fa9
- SSDEEP 384:NBS3rWnuOHTcYpdJzTwhwgniPySr64PYA0NNL52dMEBffQGbggDBiMJuS8hLhuVw:Nq0TuS8hLhuVmiL3Uj
- TLSH T1DA82B537B4149827C57663B0D9AF2501B265D28B8E013FC1B8EFA0A5271B3D5937E9CE
- MD5 SHA1 SHA512 SSDEEP TLSH
Modifies Windows Defender Real-time Protection settings
Windows security bypass
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
Drops file in Drivers directory
Disables service(s)
Stops running service(s)
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1System Services
2Service Execution
2Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Impair Defenses
5Disable or Modify Tools
4Indicator Removal
2File Deletion
2Modify Registry
4