Extracted

• • Target
    inrrrrrrrstall.ps1
  • Size 2KB
  • SHA256 f5a1233da9695c818c9b57a51b462768ea565362bc26e1813b30235fff337769
  • MD5 b0c5704d27df236dfa502225dce00caa
  • SHA1 418842c513c3ee199ae2f7c1ec0b6e3c29adf6c0
  • SHA512 31ed2c8e0f908c36cba63e7c0547cc171de0482ba8b2c35aca60da7ecf52b8d0ef525edffc4d10a336abd4afd1210973cde9d5f9725804dd5c303b631e12e198
  • TLSH
    T16E41725FA6A0426ACBB5662E94189A0A3D4B49BB141F0601367C390C3F219D7CBEE1DB
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2