Extracted

• • Target
    RoCockWorksBetterThanNew.ps1
  • Size 1KB
  • SHA256 7186e31b6f10bfe8aaa476a73375d82a7f3ea462b22645e934193bb88395fdfd
  • MD5 f0c3cdbcb7e368199f9f5376a0a572d1
  • SHA1 353cc2f08d56d83b3bd6420a5f093ec8fd24747a
  • SHA512 f3e977ac90f11783458c28282b80dee5f14243c49bfafab3a8b69a95e660e624f8ec4b7630b3639f9af99d7cd6d2ac5ef0c35023bd3f2608c65ff9e2f2e97b7c
  • TLSH
    T1F141668A97C7D32546E143D5CD5892784D3E811A17950404B3FE8285DAE4FD9CAF82DF
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Drops desktop.ini file(s)

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1