Extracted

• • Target
    mwZhV1.ps1
  • Size 416KB
  • SHA256 3fcc8667d73fc631206bd32191db3d5ab96667a1fe6e9d67e15892e0f3a9f122
  • MD5 85a253c748b836b083d3ad2c33c0d6f8
  • SHA1 f9474d9412768f26e1bce9c6f5b705abacba1039
  • SHA512 fc1b8251a49a95eaa52f4b2fafbc1dfdcb5f02eabe90506b95b5346bc2095bf5f4f66586dc971477d034148267a27a1c298044c5ebfa6f4a4e76f782a8b529ae
  • SSDEEP 12288:ooPOoeIhiBBRBAWgKEmKTJSQJYxYV0YnmEq4k5Z:jW3lPIKZkJ4xYd5q5
  • TLSH
    T13194235003F4AF004198FD3CA4DF27789FA1C4EA580A2F49F68E5A9277DB151CE3A659
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistenceadwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2