General

  • Target

    https://vewrgvbe43r50t9jgh-0hewr-gfhjw-9fhrj-wjeff.obs.ap-southeast-3.myhuaweicloud.com/ve9trf0ge905rt-0gbnf-v0rewbndfv-0wnbe-r0fnb9wefe.html?AWSAccessKeyId=BIYYVE07OMDKEILTTF0R&Expires=1663784591&Signature=x3g9OUfurCa2nDfAe7DPmkdZRqM%3D#chris.abramson@walgreens.com

  • Sample

    220823-sl1wgsghd4

Malware Config

Targets

    • Target

      https://vewrgvbe43r50t9jgh-0hewr-gfhjw-9fhrj-wjeff.obs.ap-southeast-3.myhuaweicloud.com/ve9trf0ge905rt-0gbnf-v0rewbndfv-0wnbe-r0fnb9wefe.html?AWSAccessKeyId=BIYYVE07OMDKEILTTF0R&Expires=1663784591&Signature=x3g9OUfurCa2nDfAe7DPmkdZRqM%3D#chris.abramson@walgreens.com

    Score
    7/10
    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Tasks