Overview

overview

10

Static

static

1

5619bc25b4...41.lnk

windows7-x64

10

5619bc25b4...41.lnk

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5619bc25b41f378ded1f11598c87404d06e42a8e4616feeb1392036950817d41

  • Size

    1KB

  • Sample

    240410-m5ppnsdd63

  • MD5

    ea7acd3608fd3947a4627fa8f7bb3e13

  • SHA1

    9ea546ce07d2e295f4361a16a5ff0d50100b6917

  • SHA256

    5619bc25b41f378ded1f11598c87404d06e42a8e4616feeb1392036950817d41

  • SHA512

    02b7504be393bc8d046d594039fd14d9cd85559956e69891271ae2b2e2c2e490ddd34556d3a5ee8ac8c3d6b1bc10db699fb2be01a86d9718e0d9185c980b4240

Score
10/10

Malware Config

Extracted

Language
hta
Source
URLs
hta.dropper

http://a0717288.xsph.ru/intellectual/heap.mov

Targets

    • Target

      5619bc25b41f378ded1f11598c87404d06e42a8e4616feeb1392036950817d41

    • Size

      1KB

    • MD5

      ea7acd3608fd3947a4627fa8f7bb3e13

    • SHA1

      9ea546ce07d2e295f4361a16a5ff0d50100b6917

    • SHA256

      5619bc25b41f378ded1f11598c87404d06e42a8e4616feeb1392036950817d41

    • SHA512

      02b7504be393bc8d046d594039fd14d9cd85559956e69891271ae2b2e2c2e490ddd34556d3a5ee8ac8c3d6b1bc10db699fb2be01a86d9718e0d9185c980b4240

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks