968eb7c3a9dd8cf084886f5992eff26597a1a533e4139904c5b261fba155fd55

General

Target
script.ps1
Size 4B
Sample260719-pb32bads5w
SHA256 968eb7c3a9dd8cf084886f5992eff26597a1a533e4139904c5b261fba155fd55
MD5 e9d867c56643cd1a52af144c2b5e8bd4
SHA1 22a5a12b2acf2e6ca36796b86394ec5bf430bbb8
SHA512 f7a9f5620cc045c80014af87396c48f2ec8c624735b564dbd2b9cae851156e9964337761688634ee902957a33405819c8dc57d73483642e89c6e5a1d779e7fca
MD5 SHA1 SHA512

Score

9^/10

Malware Config

Targets

- Target
  script.ps1
- Size 4B
- SHA256 968eb7c3a9dd8cf084886f5992eff26597a1a533e4139904c5b261fba155fd55
- MD5 e9d867c56643cd1a52af144c2b5e8bd4
- SHA1 22a5a12b2acf2e6ca36796b86394ec5bf430bbb8
- SHA512 f7a9f5620cc045c80014af87396c48f2ec8c624735b564dbd2b9cae851156e9964337761688634ee902957a33405819c8dc57d73483642e89c6e5a1d779e7fca
- MD5 SHA1 SHA512
Score

9^/10

adware spotify defense_evasion discovery execution persistence phishing privilege_escalation ransomware spyware
- Renames multiple (51) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- A potential corporate email address has been identified in the URL: [email protected]
  phishing
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s)
- Detected potential entity reuse from brand SPOTIFY.
  phishing spotify
- Enumerates processes with tasklist
  discovery
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral1