Extracted

Extracted

• • Target
    script.ps1
  • Size 1KB
  • SHA256 b20c8474cd5790763ba07b674ee2715c2f39e645078509fa16ce42b486543299
  • MD5 f446ef842a7d07d45380bf2f3d6e159f
  • SHA1 41b647875b6c1e0304d4d3d5cb68450daf6fe415
  • SHA512 e9336e0f265a693dab9bae7748e7091e5f924e2089287eb1a251a309ce92bbf14d23235efed48101b1ad311ae781ef2bd696cedfe3dae88d8d171f8c5b953a5d
  • TLSH
    T19D319226437ECB28C2564463CD7BA4DFCC2D49B70618F1082BEFD511E6CE228427E3A9
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwaretrojan

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral1behavioral2