Extracted

• • Target

    test.ps1

  • Size

    265B

  • MD5

    171cb361e1391bf4d9d1d4ef4d8757ab

  • SHA1

    7a03a9f5743a790485a11ae129912ead157c8b53

  • SHA256

    d2a3e3706e13d63d9de2a84eb8e7370b487025e218b157d93c86725d657a47d1

  • SHA512

    dade36eaee71fcbd2d46434470fe07c699803e0b3f057dd2426d1d20b1b7bfed5751aae1a4e8fda87ae6f99150eae8d95845cd768de0573911b807131c2d5c2e

  Score

  10^/10

  evasionexecutionspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • UAC bypass

    evasiontrojan

  • Blocklisted process makes network request

  • Blocks application from running via registry modification

    Adds application to list of disallowed applications.

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  behavioral1behavioral2