General
- Target deepseek_bat_20260928_7328a0.bat
- Size 7KB
- Sample260928-ppmlgsty7m
- SHA256 33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70
Score
9/10
Malware Config
Targets
-
- Target deepseek_bat_20260928_7328a0.bat
- Size 7KB
- SHA256 33fb74388950e4f5cf6785934a7e76dccd1411e6b7467f32d61c0a5ab6016e70
Score9/10-
Modifies boot configuration data using bcdedit
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Disables one or more Microsoft Defender components
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
1