Extracted

• • Target
    file01.ps1
  • Size 5KB
  • SHA256 ce7fbd87947193cea45da7e1c339fe7bad37d77ec0ec8de10fc90c066fdf7175
  • MD5 4e76b67532a156088e2b9edabb9cfd91
  • SHA1 6be7963e66e89db1fc7de544adf9db29e810d489
  • SHA512 68fc91ca27a776c67717b237dbadb93061b47026cbaf6b7ce649eeb49f653137b13f3c2c4be7a05a35419b7cbaba11a93fc28a3054dd05b93b613cbe3b5d1b82
  • SSDEEP 96:XJDDQ6VnCRsZEgZh2jRltnuv1tlDitBzSaXXq2WZQJWmuWqWObWVCU3SjocHsQIA:ts6VzPOnuvHlD6BzSaK24QJW1WqWwWVy
  • TLSH
    T115B1C6206F0451DCAEA2023FFD83556BBE14A08FD4165DA0F8DBC2A0BF8356EC735909
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespywarestealer

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Boot or Logon Autostart Execution: Port Monitors

    Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

    persistence

  • Downloads MZ/PE file

  • Event Triggered Execution: Image File Execution Options Injection

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence

    remove IFEO.

    defense_evasion

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1behavioral2behavioral3behavioral4