Extracted

Extracted

• • Target
    trigger.ps1
  • Size 26B
  • SHA256 5f78ec753f10791d682272dba1fa840421731552e48a1b6ce2647ff8b7e16dd3
  • MD5 289c166ca2a615e576e99f4dd512d341
  • SHA1 f7e195017a394e4a82fa2d8ae40577e907b8c355
  • SHA512 83072861cee8a6fb8698bf26810d2de9fe23ed2cff95c5a8716c57b47ab1e6a9e5865a60f5b0226d21c5e11c187d4cde5fc01d7696c47b8547664957ec9c9595
  • MD5 SHA1 SHA512

  Score

  10^/10

  discoverydropperexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Download via BitsAdmin

    dropper

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1