Extracted

• • Target
    trigger.ps1
  • Size 15KB
  • SHA256 311830df8e78687d847a703961afba79ecc1ddccd7275d1194ad6c143c5830c6
  • MD5 90500afe4073050b7df6496eb2983786
  • SHA1 92a6f4c1bd83a238085c803ccaf322a8d40ac408
  • SHA512 2db6b92780bb97c19f175589928055a7279d798eb1610591b456d4a769d4417b61ea688d98c2b1d3b8f735e39bf471448d7f262621af41f7a04c8329d59b934b
  • SSDEEP 384:ihfWCl1s8oUw3bm6YeM5sbR1R46JAsCWM:Y1Q8qjtpJ0WM
  • TLSH
    T1BA62E8E239457061C273AF3AE9A3D78DFA39403B91131614B95CC1D0AFB4F6A87A5F84
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2