Extracted

• • Target
    code.ps1
  • Size 15KB
  • SHA256 482bdef3285c0dee2c2daf96e5a479f1b3aafe5c52a3b152b4cd5beefa56ac85
  • MD5 2a93503c62bfe579221567b4be8c835f
  • SHA1 216a7c6d6f3624e314fff50a23d07f4c04d2c8ee
  • SHA512 4526284bcc19ce30890265f36b52646092162cf1dd0f5bbd4252456e4cf53000a5c3e591ee101ca09600d8c96fb9d0b2199ce0e04a34d6d20c96078c99351413
  • SSDEEP 384:iUNWCl1s8ohOSm+YiK5wCR40JAMNJojO/:11Q8CEJ/noj2
  • TLSH
    T1D872F7E3398260729273AF39E9A3D78DFA39003B91131A14795CC2D09FB1B6987A1F54
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomwareadwarespyware

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Disables Task Manager via registry modification

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2