Extracted

• • Target
    givenrestthignsaregoodformebest.hta
  • Size 25KB
  • SHA256 da4c7c0e9edf7ace0bb30d1af2abf69ebbede3582d2595c1ead8d7d50baf2c7f
  • MD5 1cd78933b519aa3af094d6e7d944886c
  • SHA1 914a4dc349c63b51577828893a9b001a58ace690
  • SHA512 3af6ec123d0dbd49cc111de2d467fe6f91923265060727d368a80eb76bd6fb150cb473d22caf0e7918916d3f3fefb3c1dfd5ebf30bc479780cd08b013cafb06c
  • SSDEEP 192:ypZLwtvu8D6KTlxAqwRyf6CEeJ5uNirU4+Dd4+DvZ/Tt2c1Fk:y8YxJGxBc26Fk
  • TLSH
    T14FC2318A638DEC7CA6F556236E52B798EF0909066C56041FB9ECC0D30D5164EC8E1BFB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionadwarepersistenceransomwarespyware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2