Extracted

• • Target
    inst.ps1
  • Size 12KB
  • SHA256 b92ce11314c730062c67543f54fcae3099b30e67d035895618658abf57a134db
  • MD5 02bf17ce720cc3c545e4b4f4e8e4bed8
  • SHA1 8abc7f88de816836d9c3eef5652abe2c1acb1fe7
  • SHA512 82d740de3aea071c6769add306141ccb5f862dcdd8523735f80249f4bbf375740acc25ce4c4fa171c0e356d460321463964e734e0021aae61d71572f90fb4ad0
  • SSDEEP 192:QtcKVUqZY1lEgC6Jgp4Z3yxQL4yQ6W+2YR/6WyYWa2Uer9hRoSE0rfOyyYs1VD7X:QvUyYYJT45TWXY88XjN2G02
  • TLSH
    T10C4252632C5874B5D0C2F633A9D75249FADE507B820C0A14BE9C81CAEFE1B6D8BBD544
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistencedefense_evasiondiscoveryminer

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

    miner

  • Executes dropped EXE

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of NtSetInformationThreadHideFromDebugger

    defense_evasion
  behavioral1behavioral2