Extracted

• • Target
    FAC1T.js
  • Size 119KB
  • SHA256 2e59f97473db1915abb38fd4c76d1eaec900e6b60dfa49486c4781f7caf242f5
  • MD5 0d9e9148811898bcdde92a7d34ca5338
  • SHA1 0dffc27e66838e39e6a1828362db5b6713f69622
  • SHA512 9dc63ec1ff3588b02de74c856a0cf4ed5d8d7961cfd090467ffca12a6f5729808c152bc056bdc0916ecb7d982d1739a23cbbf7d7e578c763ca6e3995e98c15cf
  • SSDEEP 768:dpoMqLDDgfLmhiiJLF4DzMpeeWx2SSdziryFXptLOTk:dpFCIiiZYpe1TOiryD
  • TLSH
    T100C39819FB311AAC3095F4FC89A3702C267388AFC658D175687F773449E52E068B4E9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalation

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral1behavioral2