Extracted

• • Target
    09072026_0340_photos-2026c-21323504147217.ps1
  • Size 22KB
  • SHA256 70c0cd181e7daf92f55c917a3b55edb81bca24bfa1d14e6d983b811ca29a9602
  • MD5 c172ff2e417a7af9a8501a049436e5e6
  • SHA1 2a228487f7dfcb382aef11de0897486b8c8dca6e
  • SHA512 cdc09995e7b18a590c897337bc1b24be52fa1153a29caf57448debae65164fa51c19d7efa3697a1742c4a4a74cfcea1d46dfcd986d66980e624575a86dc1cb92
  • SSDEEP 192:HrAByReiCc1mh4PwnFHolx6bC1z0T9/T9IdQiAQFDDbSILSIjFbOXyz7uKZnoYoj:8QtDnRXnoLgIw1/ReQ5QaXCkUtYeJ
  • TLSH
    T124A2E92B37270CF687817AA588E7E10CF16451B7605D6ECCF88C8259EF62A3583FD691
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionpersistenceadwareransomwarespyware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2