e9d778b2d095d63905ce207ca8e3f7730459e962d6ec9257afff91d7f05ed4c0

General

Target
file01.ps1
Size 11KB
Sample260619-ye94gact5s
SHA256 e9d778b2d095d63905ce207ca8e3f7730459e962d6ec9257afff91d7f05ed4c0
MD5 3daa58c41b0f903b6b66477f3e1bfca5
SHA1 86b133540c42b1e0c79aa6b37e0c57b48cd1c390
SHA512 7520e6985de4c329dfc5a0020cc04a0873b91955c7e3a45085585a80e1e663333e336596d07017c019ee358ca792ee456f406adc24aa12799cc505c683a943b5
SSDEEP 192:GlYLD+X+h8JC5w/RvY0V8kdGdOZ3YXpXWrjDZacf4EXQ:GkD4KmCSQ01d5hKhQjDa
TLSH
T1123283223B096165C5F38732D993D216FE2BE06B4252661436ADF0903F718BFC3B9E64
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  file01.ps1
- Size 11KB
- SHA256 e9d778b2d095d63905ce207ca8e3f7730459e962d6ec9257afff91d7f05ed4c0
- MD5 3daa58c41b0f903b6b66477f3e1bfca5
- SHA1 86b133540c42b1e0c79aa6b37e0c57b48cd1c390
- SHA512 7520e6985de4c329dfc5a0020cc04a0873b91955c7e3a45085585a80e1e663333e336596d07017c019ee358ca792ee456f406adc24aa12799cc505c683a943b5
- SSDEEP 192:GlYLD+X+h8JC5w/RvY0V8kdGdOZ3YXpXWrjDZacf4EXQ:GkD4KmCSQ01d5hKhQjDa
- TLSH
  T1123283223B096165C5F38732D993D216FE2BE06B4252661436ADF0903F718BFC3B9E64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware trojan
- Modifies Windows Defender DisableAntiSpyware settings
  evasion trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Port Monitors
  Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
  persistence
- Disables one or more Microsoft Defender components
  Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
  defense_evasion
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Creates new service(s)
  persistence execution
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Impair Defenses: Safe Mode Boot
  defense_evasion
- Modifies system executable filetype association
  persistence
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4