Overview

overview

10

Static

static

10

RENAULT_ME... 2.bat

windows10-2004-x64

10

RENAULT_ME... 2.bat

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    02112026_0255_28092026_RENAULT_MEGANE_Araç_Tescil_ve_Ruhsat_Bilgileri.PDF 2.bat.rar
  • Size 1KB
  • Sample261102-deebksev8s
  • SHA256 332fd70920073a113aa9e2b9cfce1cca459132d40c3d96d3d5f21f2fea6a8c49
  • MD5 SHA1 SHA512 TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionransomwaretrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    http://74.208.93.179/tat.exe
  • exe.dropper

    http://74.208.93.179/tat.exe

Targets

    • Target
      RENAULT_MEGANE_Araç_Tescil_ve_Ruhsat_Bilgileri.PDF 2.bat
    • Size 4KB
    • SHA256 286619cb4364f0e8acbf4cc16206669bcd829768db68609a3a414ca8b016d1f7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryevasionexecutionransomwaretrojan

    • Modifies Windows Defender DisableAntiSpyware settings

      evasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      defense_evasiontrojan

    • Modifies Windows Defender notification settings

      defense_evasiontrojan

    • Clears Windows event logs

      defense_evasionransomware

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Disables service(s)

      defense_evasionexecution

    • Discovers running processes

      Running process information can be used to identify security tools or plan follow-on actions.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks