Overview

overview

10

Static

static

3

a299e230a1...52.exe

windows7-x64

3

a299e230a1...52.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a299e230a172c79e5d30de052.exe

  • Size

    3KB

  • Sample

    230704-qthzjafb2y

  • MD5

    a299e230a172c79e5d30de052cefaddc

  • SHA1

    9ac47e62085f05a4ce58bd999332ab04fee40e30

  • SHA256

    177b40f96a09a3919b2c8846ca73abb09855d078ff9dee89610bc2b75d44cb31

  • SHA512

    0ca74bb6c51bc374be01402aa8e4a284c1730c49ba6ba1425871c754e1dfd8a7b7bfe92dd6e854941f299e724488ef5474f92253001503a8f38531b395e6b509

Score
10/10

Malware Config

Targets

    • Target

      a299e230a172c79e5d30de052.exe

    • Size

      3KB

    • MD5

      a299e230a172c79e5d30de052cefaddc

    • SHA1

      9ac47e62085f05a4ce58bd999332ab04fee40e30

    • SHA256

      177b40f96a09a3919b2c8846ca73abb09855d078ff9dee89610bc2b75d44cb31

    • SHA512

      0ca74bb6c51bc374be01402aa8e4a284c1730c49ba6ba1425871c754e1dfd8a7b7bfe92dd6e854941f299e724488ef5474f92253001503a8f38531b395e6b509

    Score
    10/10

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks