Extracted

• • Target
    file01.ps1
  • Size 226B
  • SHA256 19ead3ae2123d5208f3c8cbccdad1fc23ed18509af27228d41cdc8af30c66cfd
  • MD5 d5d9d5586dcd0c826aa0ad489d70dc14
  • SHA1 71e3385dc7de6e3c058c095d4c581fcfa4068ec4
  • SHA512 41baff94b189e069fca42967185d4536ed75f9812f5ea5a8069db5162afff61b88fd926020cd51a180ac2c65582432a9e2bc5eb7d9c2764cba29c5d0d4ad63f4
  • TLSH
    T161D0977AD51CE74C932260EAA4DC7A7AA06A124CC73050402374CE8884102208329987
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionransomwaredefense_evasiondiscoveryimpactpersistence

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2