Extracted

• • Target

    ServerFAH.ps1

  • Size

    134KB

  • MD5

    327fee2e572cf6b3b337fded32308189

  • SHA1

    8046a0f02d0673d3833b40bc5ac885b0a8891079

  • SHA256

    32060ba18c4ed29f6a441b6193a2e6376bb43c752709558f046e9365b7275559

  • SHA512

    be2e0938b929177621c7b9d324c2245ecef46e9b9b1b93204e1663edc2e9ee12f05e3e350362f7a6863d906bff2eb3e3b804a66d05a5c4cb4e87a7175b12bea8

  Score

  10^/10

  nwormdownloaderworm

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2