Overview

overview

10

Static

static

10

trigger.ps1

windows10-1703-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    trigger.ps1
  • Size 789B
  • Sample230408-xd7raaef79
  • SHA256 40629145959cd05252bb4da657364c4f999a8e5f2d8f8fce02b3a2d2d3bd55e9
  • MD5 SHA1 SHA512
Score
10/10
ransomware

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://www.google.com/search?q=saul+goodman&tbm=isch&tbo=u&source=univ&sa=X&ved=0ahUKEwi4t4yhs4_TAhUEzGMKHbgdBu8Q7AkIRA&biw=1920&bih=950
  • exe.dropper

    https://www.google.com/search?q=saul+goodman&tbm=isch&tbo=u&source=univ&sa=X&ved=0ahUKEwi4t4yhs4_TAhUEzGMKHbgdBu8Q7AkIRA&biw=1920&bih=950

Targets

    • Target
      trigger.ps1
    • Size 789B
    • SHA256 40629145959cd05252bb4da657364c4f999a8e5f2d8f8fce02b3a2d2d3bd55e9
    • MD5 SHA1 SHA512
    Score
    8/10
    ransomware

    • Blocklisted process makes network request

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks