Extracted

• • Target
    run.ps1
  • Size 13KB
  • SHA256 e04d51956b68a863efc95c041ea45b5d4ef19fc0ad163ae7029187dd6596216d
  • MD5 6ab69991ca6c494293ec12863be7f145
  • SHA1 62e8c647b206a037fbc1e41be474fb994a634399
  • SHA512 97138ed896cf1f199bbad30b0860a68161d9545a66a8ed079ef16ef5854c2c6f57c80cbf2a73ed8e5dc16a93d690f6819039296c7e489053fe0a8f9bec3aecf4
  • SSDEEP 384:i06mGZDpsjUW+i8i1T0iti4lbl1R46JAsCWM:/QGxPx1Tpc4lhpJ0WM
  • TLSH
    T18352B7623D4935619273DF39DAA39349FA36003B92170A14B99CD2D08FB4F2687E5F88
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2