General
- Target target.ps1
- Size 2KB
- Sample261024-wts3dsbv8x
- SHA256 fd046ff2bf93108eb828d4e1469511913553910843d013a938c1444e30cf069a
- MD5 28bd26b05f39eb86ad50da46ffdc3994
- SHA1 3063f5a8d9855ebed23707329832f4551eccd0ec
- SHA512 09d3c6c05f669581d7d1aaf37c84a642983cbfbf48090bf1f91e1fe01ca802f879f054e8c6651d6d60d5ccc114cda754a2f7bc156d86f89d859e6c4881a91ffd
- TLSH T12841876012025ADA5872652AD508740EF987403F37EB650575DC0A382FFA318C73B66A
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
target.ps1
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
target.ps1
Resource
win11ltsc2024-20260911-en
6 signatures
150 seconds
Malware Config
Targets
-
- Target target.ps1
- Size 2KB
- SHA256 fd046ff2bf93108eb828d4e1469511913553910843d013a938c1444e30cf069a
- MD5 28bd26b05f39eb86ad50da46ffdc3994
- SHA1 3063f5a8d9855ebed23707329832f4551eccd0ec
- SHA512 09d3c6c05f669581d7d1aaf37c84a642983cbfbf48090bf1f91e1fe01ca802f879f054e8c6651d6d60d5ccc114cda754a2f7bc156d86f89d859e6c4881a91ffd
- TLSH T12841876012025ADA5872652AD508740EF987403F37EB650575DC0A382FFA318C73B66A
- MD5 SHA1 SHA512 TLSH
-
Deletes shadow copies
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.