Extracted

• • Target
    setup.ps1
  • Size 2KB
  • SHA256 9e60a5852a7a673b7084f7cda25385c04a4ef1a5841b85862b3df193f39b988c
  • MD5 b2970f07d4cf480dacc739578a6e15bf
  • SHA1 a8483b3048da115a2d98e500b67a529d8f068a5b
  • SHA512 ab8cf32bbe9a4123927e1c06f872f8c53b4789bc6e45be789cbd1378bfe874d6ee7a710e53e33243442dfe34394cd949f05287b92e684a30e2bf94cb924d2a99
  • TLSH
    T10E518A1C5A86122595D606BF78CBA2012BAF543F804E5F14B85D81D43FF86AFCBE26C3
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

    Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

    defense_evasion

  • Hide Artifacts: Hidden Window

    Windows that would typically be displayed when an application carries out an operation can be hidden.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion
  behavioral1behavioral2behavioral3behavioral4