Extracted

• • Target
    file.ps1
  • Size 140B
  • SHA256 15b1b7017fc89766efcbf03c32e06d73f83d81c26da9c43ea9761a80b35fac4c
  • MD5 70dbeba8757f2ac7f32df3a25a3280b5
  • SHA1 627f4d8e622f9868cc5eb7885d47ffc32ca0ba4d
  • SHA512 a7c16ace16e6233838f8cc88af3b331af3e3784325fc511d9081123ee4bb074ba544d3dbca8029145d4f2c784d366c02a3c0038cf323d9bcfeda0f6f3aeaa356
  • TLSH
    T14DC02B9DD558E45C5A0252F9D26D3D9FC0291785C77064C473208D5C8EA0C34A37D0EF
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionimpactpersistenceransomware

  • Modifies WinLogon for persistence

    persistence

  • Deletes shadow copies

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2