Extracted

Extracted

• • Target
    2026-08-17 18-33-06.mp4
  • Size 126.2MB
  • SHA256 2f8b36e6f9fac46985402ecf92eea817845013eeb9da470dfcf89783f7313e3a
  • MD5 7a098601cfd1a620d6fbbe1719c12ab5
  • SHA1 9689e1d80dcfb523b2dd3821169ae571c45aebcf
  • SHA512 05dc89aa9af726f260f989ebd11ae0d23286ea6b275d132c22b90f45ebe13d91aee6f081d0e6b2dae16f98dff39f2e9e5ddbe72df7fb4122fd0c3238e8eeac7a
  • SSDEEP 786432:AIdzYRhmls+zotyHl+m0mK5i2FGXeOtTxMkWZ:AIyRhMmOwvi2IOOtdna
  • TLSH
    T11F5823683361DC86EB646F34CD9CC3C950B8AD62BDC40D17789937BFA8306D59824ADE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1