Overview

overview

9

Static

static

1

script.js

windows10-2004-x64

9

script.js

windows11-21h2-x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    script.js
  • Size 3KB
  • Sample260507-sa3wpse18w
  • SHA256 f0b186d7f47c131f3434676e9e87d14cfbea7b3c26ba49d95e2c08b28a5f8510
  • MD5 SHA1 SHA512 TLSH
Score
9/10
defense_evasionexecutionransomware

Malware Config

Targets

    • Target
      script.js
    • Size 3KB
    • SHA256 f0b186d7f47c131f3434676e9e87d14cfbea7b3c26ba49d95e2c08b28a5f8510
    • MD5 SHA1 SHA512 TLSH
    Score
    9/10
    defense_evasionexecutionransomware

    • Clears Windows event logs

      defense_evasionransomware

    • Disables one or more Microsoft Defender components

      Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks