Overview

overview

8

Static

static

1

connect.ps1

windows11-21h2-x64

7

connect.ps1

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    connect.ps1.ps1
  • Size 25B
  • Sample261107-ppzaaafa23
  • SHA256 0e11be816205f9fcbbb2706f59126003fb316b972aa92118e2fbc23f2032a2e0
  • MD5 SHA1 SHA512
Score
8/10
adwarecommand_and_controlexecutionpersistenceransomwarespyware

Malware Config

Targets

    • Target
      connect.ps1.ps1
    • Size 25B
    • SHA256 0e11be816205f9fcbbb2706f59126003fb316b972aa92118e2fbc23f2032a2e0
    • MD5 SHA1 SHA512
    Score
    8/10
    command_and_controlexecutionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Outbound SSH connection to public host

      SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

      command_and_control

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks