Extracted

• • Target
    install_slutware_qn6FAm.bat
  • Size 2KB
  • SHA256 1a759b1b5b1cd3e7b77a98477b2e407c8dbf584005c52e52044d45ccd4d1906c
  • MD5 248de64cf5055ddcae0ce616733c29eb
  • SHA1 8151ad905bea37021d6fe83295b9bae46a57405d
  • SHA512 6168f37c579e7bae3c350b0a93297741e5a3e41cdbcf9dfefc849b8335a015c62dcf45da2fa02916b857fda5b28a8b15e39aabcdcd05dfa4ff61d0d7ac2e8d7a
  • TLSH
    T1214165416D9613A17A37C5B0C70E6A04E30FCA0B34CD04B871E74096E862F1DA9FE5D8
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarestealer

  • Grants admin privileges

    Uses net.exe to modify the user's privileges.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Downloads MZ/PE file

  • Indicator Removal: Network Share Connection Removal

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2