dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f

General

Target
target.ps1
Size 12KB
Sample260701-wkllysc14v
SHA256 dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f
MD5 ba308282055c8dfbdea4bd6821d5843b
SHA1 aba314b41460213c0704155010a45e6b9d24d39e
SHA512 8f77986bd52d8ed1f2972ef16b77500b3df1a989cad12014fb398e86c1a8ca56f7061e05ec0fbd9a4ac802aa7c00672b8d82b09589b5b1aacda37a4974da34ed
SSDEEP 192:Mt14EX0PIVal6JmpxTAZ8Wm2ocMSKLcynIrDmgAQe5EmIvvf+eTY8fvKiNiRHBk6:tgV5JMJcMSKLHInAomIvu4P8uuyE
TLSH
T16942A645AB15526585B29B24DDC2A29AFF3B003F11B75200B5ADC2907FB253ACB39ECC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

Malware Config

Targets

- Target
  target.ps1
- Size 12KB
- SHA256 dedca95b1c824184bac5870a1e12686c8d9fd4090070edf7cb96eb339e8ac34f
- MD5 ba308282055c8dfbdea4bd6821d5843b
- SHA1 aba314b41460213c0704155010a45e6b9d24d39e
- SHA512 8f77986bd52d8ed1f2972ef16b77500b3df1a989cad12014fb398e86c1a8ca56f7061e05ec0fbd9a4ac802aa7c00672b8d82b09589b5b1aacda37a4974da34ed
- SSDEEP 192:Mt14EX0PIVal6JmpxTAZ8Wm2ocMSKLcynIrDmgAQe5EmIvvf+eTY8fvKiNiRHBk6:tgV5JMJcMSKLHInAomIvu4P8uuyE
- TLSH
  T16942A645AB15526585B29B24DDC2A29AFF3B003F11B75200B5ADC2907FB253ACB39ECC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

discovery evasion execution exploit ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Drops file in Drivers directory
- Possible privilege escalation attempt
  exploit
- Modifies file permissions
  discovery
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

2

T1059.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1

T1490

Tasks

Sharing

General

Malware Config

Targets

Modifies boot configuration data using bcdedit

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Possible privilege escalation attempt

Modifies file permissions

Drops file in System32 directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4