71a31738ccca7cecc282a5ba69fd2b2a4083771869d5a8e62d1d7f9e5996b808 | Triage™

Login
Reports

Overview

overview

Static

static

1

SHBA7x Fre...ty.cmd

windows10-2004-x64

3

SHBA7x Fre...ty.cmd

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
SHBA7x Free Tweaking Utility.cmd
Size 519KB
Sample260912-tkdj8ssxcz
SHA256 71a31738ccca7cecc282a5ba69fd2b2a4083771869d5a8e62d1d7f9e5996b808
MD5 34f53b86ac17c6b0b3f952f765b21582
SHA1 600432adf657bee30ca923ad2d2ebaccabc6ac9a
SHA512 eda8e93893193aa89f3cdce3b6447b68c1224452042410acafc31408e0eb8e8ad1995dc8f5de850ecbe3f916fb7b6479dada26c1f40167dfb62ce5baf6e4f1d4
SSDEEP 3072:tWMAw74qzKs4R30WM83bCXVs7sdNRAVA49VF4:o3bCXVs7sdNRAVAWVS
TLSH
T15DB40E35B12A2332C6ADAE116672DD2E6B766AC3E5305B40F4EF20C81F77481EC799C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence ransomware

Static task

static1

Behavioral task

behavioral1

Sample

SHBA7x Free Tweaking Utility.cmd

Resource

win10v2004-20260911-en

windows10-2004-x64

6 signatures

150 seconds

defense_evasion execution

Behavioral task

behavioral2

Sample

SHBA7x Free Tweaking Utility.cmd

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

22 signatures

150 seconds

defense_evasion discovery evasion execution persistence ransomware

Malware Config

Targets

- Target
  SHBA7x Free Tweaking Utility.cmd
- Size 519KB
- SHA256 71a31738ccca7cecc282a5ba69fd2b2a4083771869d5a8e62d1d7f9e5996b808
- MD5 34f53b86ac17c6b0b3f952f765b21582
- SHA1 600432adf657bee30ca923ad2d2ebaccabc6ac9a
- SHA512 eda8e93893193aa89f3cdce3b6447b68c1224452042410acafc31408e0eb8e8ad1995dc8f5de850ecbe3f916fb7b6479dada26c1f40167dfb62ce5baf6e4f1d4
- SSDEEP 3072:tWMAw74qzKs4R30WM83bCXVs7sdNRAVA49VF4:o3bCXVs7sdNRAVAWVS
- TLSH
  T15DB40E35B12A2332C6ADAE116672DD2E6B766AC3E5305B40F4EF20C81F77481EC799C5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution discovery evasion persistence ransomware
- Modifies visibility of file extensions in Explorer
  defense_evasion
- Modifies visibility of hidden/system files in Explorer
  defense_evasion
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Event Triggered Execution: Image File Execution Options Injection
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Windows Command Shell

Persistence

Event Triggered Execution

Image File Execution Options Injection

Privilege Escalation

Event Triggered Execution

Image File Execution Options Injection

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

Tasks

static1

behavioral1

defense_evasionexecution

behavioral2

defense_evasiondiscoveryevasionexecutionpersistenceransomware

© 2018-2026

Terms | Privacy