Extracted

• • Target
    file01.ps1
  • Size 13KB
  • SHA256 91ed23c20d3e9409d93c3e2871b87ba824a7cc97c0abafe92e0a89324cf37c21
  • MD5 9f2cb6a5204f5b262be41ee03e699959
  • SHA1 f00a1d039c0ccd627613b236f508cd3e192f3ee0
  • SHA512 3e2a11840c8444166234e4b16260e9e48273151d68bd6e1d5b4c60dca77047d287f47d6ba00314c42e916f89e26e3aafbd4d486d2e1f1ab03265305c42729190
  • SSDEEP 384:ifSGZDpsjU/Kisi+vki9irbR1R46JAsCWB:zQGqzh+vZsrtpJ0WB
  • TLSH
    T1AD52A6923D45349192739F36EAA3938EF635003B52170A14B99CC2D09FB5F3A87E5F88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2