Extracted

• • Target
    trigger.ps1
  • Size 10KB
  • SHA256 d329826e5c6001821ffacc1272d6d5d73adffb94cad483d9a27e074f34c8e181
  • MD5 121cc47e79f4d4d991862135ea8363be
  • SHA1 6d39940b02a06f06d31182efee5959bbdb68faeb
  • SHA512 2d36d5d58afce7bd06d21f9387dc813c5b2020b1952651f2cdee5208bb1d102f9088dd5f16444965b6fa904c11343a68cb1c4b010fbee93bbb59f7961cf9772d
  • SSDEEP 192:yI0nBYrrkwRWQCcc1KM3Ea9Cpli4ZUaeHfmAK//ZI14EMz6B:ylYrrnYXcc1KAEagpli4MSIwA
  • TLSH
    T1CD22C4657725A166C7F3DB37D887A106EE3B502322629900B8BCD590BF78069C338FC8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionexploit

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Possible privilege escalation attempt

    exploit

  • Modifies file permissions

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4