415e7df1ecf2edbbdc54903c63b3ca692ed63a1b76bfefb84e3305e701194e5f

General

Target
trigger.ps1
Size 5KB
Sample260620-jmaagsdz2k
SHA256 415e7df1ecf2edbbdc54903c63b3ca692ed63a1b76bfefb84e3305e701194e5f
MD5 360c9fe23f5addcf618ee4bed4fbaf9f
SHA1 3d3f429549b19f57857485eb93dd49b55422ecec
SHA512 9bec194bb621ba37b04cc70a03cedd1429b29b95d4a4ec58ff88eb92a7446b6f5d5ac146c57d87f0dc180ecf916b7ce9cdb4a50137894e2642282f852ef8d0ee
SSDEEP 96:q57emPEw621kmB4GRhKF8hqN+ZGChZCldZzYSoExm4AczSAnVCAjofb37XoJ:14Ew/1kQTKwqN+ZGCholdZzYpExmI+A3
TLSH
T133C1D782738991D450734A36F143F9AAF936813EA0B74A00719CF3C4AFB890DD771D69
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  trigger.ps1
- Size 5KB
- SHA256 415e7df1ecf2edbbdc54903c63b3ca692ed63a1b76bfefb84e3305e701194e5f
- MD5 360c9fe23f5addcf618ee4bed4fbaf9f
- SHA1 3d3f429549b19f57857485eb93dd49b55422ecec
- SHA512 9bec194bb621ba37b04cc70a03cedd1429b29b95d4a4ec58ff88eb92a7446b6f5d5ac146c57d87f0dc180ecf916b7ce9cdb4a50137894e2642282f852ef8d0ee
- SSDEEP 96:q57emPEw621kmB4GRhKF8hqN+ZGChZCldZzYSoExm4AczSAnVCAjofb37XoJ:14Ew/1kQTKwqN+ZGCholdZzYpExmI+A3
- TLSH
  T133C1D782738991D450734A36F143F9AAF936813EA0B74A00719CF3C4AFB890DD771D69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

bootkit credential_access defense_evasion discovery evasion execution persistence ransomware stealer impact
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- Boot or Logon Autostart Execution: Print Processors
  Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
  persistence
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Deletes itself
- Drops startup file
- Indicator Removal: Clear Windows Event Logs
  Clear Windows Event Logs to hide the activity of an intrusion.
  defense_evasion
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1 behavioral2