Extracted

• • Target
    ibredgoodforbestthingscomingbackform.hta
  • Size 27KB
  • SHA256 e6faa8d9189b089d38c728bec9e02b709346650796503807b928e5b0c0a680f9
  • MD5 52b725b8144745f2885198d514a805eb
  • SHA1 cd3b3de6c894b9cd3bd3b9cfcf00077adb88877b
  • SHA512 a59e37b9b079f292fb16fab894ee513d1778d2c6e007741f549ba260813516a1fb38bd3da3182f192469fcdc40377f5a067795434ba5b57d4f4cdff577866297
  • SSDEEP 192:OIAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IAn5IA4:VAEDZZ86gRkx6ZkiOIOx73
  • TLSH
    T19DC2A00E9E499CB42909F589F90A0D20683289C4E418D3EDFCACCFDF66A185E576437F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionadwarepersistenceransomwarespyware

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2