General
- Target target.ps1
- Size 6KB
- Sample261002-p1rdtasgrf
- SHA256 5abf4007884ef31733532f9ed0d9638dfacfa647fb950c954cc3905af1eeb40d
Score
9/10
Malware Config
Targets
-
- Target target.ps1
- Size 6KB
- SHA256 5abf4007884ef31733532f9ed0d9638dfacfa647fb950c954cc3905af1eeb40d
Score9/10-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Enumerates VirtualBox registry keys
-
Looks for VirtualBox Guest Additions in registry
-
Modifies boot configuration data using bcdedit
-
Deletes backup catalog
Uses wbadmin.exe to inhibit system recovery.
-
Looks for VMWare Tools registry key
-
Looks for VMWare services registry key.
-
Deletes itself
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Management Instrumentation
1Defense Evasion
Direct Volume Access
1Indicator Removal
4File Deletion
4Modify Registry
1Virtualization/Sandbox Evasion
4