0439f45fe4ff36b95fae5607cf6789965cf389f0554ac7f6727b37b5b1ce06f9

General

Target
Reset Icon & Thumbnail Cache.bat
Size 1KB
Sample260912-p6yebahn3t
SHA256 0439f45fe4ff36b95fae5607cf6789965cf389f0554ac7f6727b37b5b1ce06f9
MD5 dec8ae4bfe7fbbeb0f2f3ead83784bcc
SHA1 ed365e6b9bc3783c9d4ef4d9f28251bf54ae26b9
SHA512 bd5d23982fe4a14ae843ad7fb2e857f42cc36b3333c07d1ed12fb704d9fac781b1def8a78423f59b9eecf8f9ebd8657851ce5b57fc6dee28ee180eb5028d9e9f
TLSH
T12C2123A0B10A3400AFF109C1EC296AA5EF04B25BCB884D85F0DF67BCAB13B4835BD0C5
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  Reset Icon & Thumbnail Cache.bat
- Size 1KB
- SHA256 0439f45fe4ff36b95fae5607cf6789965cf389f0554ac7f6727b37b5b1ce06f9
- MD5 dec8ae4bfe7fbbeb0f2f3ead83784bcc
- SHA1 ed365e6b9bc3783c9d4ef4d9f28251bf54ae26b9
- SHA512 bd5d23982fe4a14ae843ad7fb2e857f42cc36b3333c07d1ed12fb704d9fac781b1def8a78423f59b9eecf8f9ebd8657851ce5b57fc6dee28ee180eb5028d9e9f
- TLSH
  T12C2123A0B10A3400AFF109C1EC296AA5EF04B25BCB884D85F0DF67BCAB13B4835BD0C5
- MD5 SHA1 SHA512 TLSH
Score

8^/10

adware defense_evasion discovery execution exploit installer persistence privilege_escalation ransomware spyware trojan
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Downloads MZ/PE file
- Possible privilege escalation attempt
  exploit
- Deletes itself
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Modifies system executable filetype association
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1