Extracted

• • Target
    OpenWordDocument.ps1
  • Size 4KB
  • SHA256 20f000b9b9831ad330abd15f1c04b2f708a460c829a1cc42af05bf3061ad5358
  • MD5 32ca8b45312670d04aaaf311d0401245
  • SHA1 626b3c29c1b50aefebdd8472e022b6ac43b450a2
  • SHA512 d8687f8a9504ddb98de32ba46115c2c9da6e47bb0ab8a7d62806b68bec52a83ce9bec4eb69bcacc5d6a10c378ff0f7a94e2d3e6b8ef4768e5ca43aca29f7312c
  • SSDEEP 96:y5hVgiyRoymudN4HLHACj7oPP67uZGeymC:y50qudNqlHoPP67v1
  • TLSH
    T19091632A5506413A62F2033799819155FECB493FC6092840F8AD8081BFF2F6E87D6FB7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Uses WMI to collect hardware manufacturer information

    Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

    defense_evasion

  • Drops file in System32 directory

  behavioral1behavioral2