Extracted

• • Target
    c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
  • Size 32KB
  • SHA256 c0ddf84e29374cd53ff4a44ff50e88e1b663fae404bc1a5200bbac38c8d1df36
  • MD5 f771bacddb1ea53e4e04f73cdb5f799e
  • SHA1 51105a9b8201817ec70ea1dba43f09fbfa5a8663
  • SHA512 4f461543abd03eb650de9e930e13beeaa4ab862f71efc8494671f7f8034ab43305666ae7da8958b54bc2e7bf950915d8d5d9072ccb1e7882fefb4c4f324fe0ab
  • SSDEEP 384:pWU4afig0dV2ePOYly3M5NEXagSoex5Pey3M5sC0x:lgf3PfWMdeWMmCU
  • TLSH
    T1C3E2C61776449331C58657314A2FD7F48B36AC588F675522329AF38C2F729D062BBBE0
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceprivilege_escalationransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2