Extracted

• • Target
    target.ps1
  • Size 12KB
  • SHA256 1e4388c45e8b07ca77b7e3b59fc1152b6c74668aad15df1e9230489b5ab3b827
  • MD5 4c47e1405c6fa862f6cda3b2d2a82469
  • SHA1 3966cd1be2209ebceb1a8827cfaa4cac4f357d58
  • SHA512 62b47860e2a8dfe89cd7270c12b156532fe7f18771553e75401c47105ca4dc93cf4149cb043d36a165cde5f8bcbfe8445795ffedcd8bf7a6cd8f84e3ffb67c52
  • SSDEEP 192:IxpsFtt8sPbKr0wsJThJ1mrLLqmNtoiuVm/1/RxCCWEKM3uCCr597AH14EM1f:IfUt8wKr0n80PVm/vxBWEKAuBr5RAHi
  • TLSH
    T1B54283517A24A266CAF2DF3AD8D7E506DF6F503B11629A0039ACD090BF71166C338BC9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionexploitpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Possible privilege escalation attempt

    exploit

  • Modifies file permissions

    discovery

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4