8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319.exe
Size

698KB
Sample

240517-b9sfkscb35
MD5

afa7016a6398f596c5e151b4d6923d7c
SHA1

057ff7d526572c000b3a427c91770479a4110388
SHA256

8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319
SHA512

85a93da98e9684c35bf04211ba54d9fcc836b45a45d998c742d61aa9c1059d495f7731e3b2e28e7f83328f5e18dfec30c5ba0bcf68d35a6bf261d6dd1d0a876b
SSDEEP

12288:fRm2iNfaxxwxtmmPOVI6qzO2+0DW5ldqqk1vZjhYhHn0t0TrXrpJWf4LOxEa:fc1Naxxwr1bRbabkp1RqhH0CDrTAEa

Score

8^/10

execution

Malware Config

Targets

- Target
  
  8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319.exe
- Size
  
  698KB
- MD5
  
  afa7016a6398f596c5e151b4d6923d7c
- SHA1
  
  057ff7d526572c000b3a427c91770479a4110388
- SHA256
  
  8019ad825c81ba5c7c447148f0d7f8034c6c2b48bf92a448e72983b593fa7319
- SHA512
  
  85a93da98e9684c35bf04211ba54d9fcc836b45a45d998c742d61aa9c1059d495f7731e3b2e28e7f83328f5e18dfec30c5ba0bcf68d35a6bf261d6dd1d0a876b
- SSDEEP
  
  12288:fRm2iNfaxxwxtmmPOVI6qzO2+0DW5ldqqk1vZjhYhHn0t0TrXrpJWf4LOxEa:fc1Naxxwr1bRbabkp1RqhH0CDrTAEa
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2