27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63 | Triage

Sharing

General

Target

27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63.exe
Size

735KB
Sample

240517-bkm5kaaf62
MD5

fa464b88b8d056baa452abd50de4d9cc
SHA1

5e3809c4b465eeb16e61b531ba82fb890cb45d3e
SHA256

27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63
SHA512

2363a0066c141c61e761c7e28b69ebdbf5ee1d33f09ce618b7567ce25e0c858b679ba65c3f4d4b078f30c72f5a55f6aa734840dbe8caf1933469a74c3c710572
SSDEEP

12288:r0pei36RgGQmndBMAygXmTzwLkp7VX3ypdfJzZT2JzT5KWyGuF6QjH0:Ypp36yGBrzXyikZBypxJzZT2f5ynIeH

Score

8^/10

execution

Malware Config

Targets

- Target
  
  27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63.exe
- Size
  
  735KB
- MD5
  
  fa464b88b8d056baa452abd50de4d9cc
- SHA1
  
  5e3809c4b465eeb16e61b531ba82fb890cb45d3e
- SHA256
  
  27933dab971d59c6643782d5ba06a20be1a4d6de96c1d817d8643a59bff24a63
- SHA512
  
  2363a0066c141c61e761c7e28b69ebdbf5ee1d33f09ce618b7567ce25e0c858b679ba65c3f4d4b078f30c72f5a55f6aa734840dbe8caf1933469a74c3c710572
- SSDEEP
  
  12288:r0pei36RgGQmndBMAygXmTzwLkp7VX3ypdfJzZT2JzT5KWyGuF6QjH0:Ypp36yGBrzXyikZBypxJzZT2f5ynIeH
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2