Extracted

• • Target
    WinDebloater-main/Windows10DebloaterGUI.ps1
  • Size 85KB
  • SHA256 60eda38fe71bb13755d3e2457df4dffc83efec4258bfb9578b062ee53b274ab5
  • MD5 29b832a6e0c4f0cd9c603c11e76b6d81
  • SHA1 f26b38cedadf17c389916e0ca57aa7c969f6945d
  • SHA512 2b150e1c7862d6ee433f534cfebe92e4b384d1216946eb3b18699a4e8bd499b132db2b9031dc61fc076caf5763db5c5a5c4022919e55550ef355bb163fb4fbb1
  • SSDEEP 768:otZGyiSUm4V+6C3+H+KUonoJ81NATn5nALIE4BebkpPdMgeO0GpKGFWZpfXphFxJ:ooSUm4V+++2fGQUE
  • TLSH
    T1EC83E931DA60E99552E7702B9C97CC805E694277E224AE0075CEC24CFF963ACC7B56E3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    WinDebloater-main/start.ps1
  • Size 6KB
  • SHA256 093f4b83dfc6a7fef1075a36e3b1c4037c07f78e09d821ee0ccf97fb764817f0
  • MD5 d4ce7ea884ba240eabe76f893fadfcde
  • SHA1 c2401d2b9dafa47c8a93e633ea383b65468f4bb7
  • SHA512 529471c354b6838eeac2458e17799445fd45d09ae55d43270c3ab4126395dc2b4b341edc53530cf61c1c176713cd7511057f6831f61eac86fcedd6b7a41bd57f
  • SSDEEP 192:/DVLo4Up1xfYKH95q95udzYFYFAEwN0K84Pi66ONvxyGivS:/Dh0/rDqDudzy7Lr6i
  • TLSH
    T1D1D195118A844A64119F0ABE3066F145A5E56227B08CF819F9DDC3A6CFC479DCD71BCB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4