970e42e01f0a5e0ae87a79fb209acae605eefa6c168c8008fbc9f544e405b683 | Triage

Sharing

General

Target

970e42e01f0a5e0ae87a79fb209acae605eefa6c168c8008fbc9f544e405b683.exe
Size

819KB
Sample

240607-cmgw1aha74
MD5

12b9b84dad30fa72eb661f353b61e734
SHA1

4fd8377e65e1cafa730ddb07d99ba64774b979f8
SHA256

970e42e01f0a5e0ae87a79fb209acae605eefa6c168c8008fbc9f544e405b683
SHA512

39b7023a8174107ab77340bbec44cce8f047149acc9fa1bc520ce856433e2b5a4b2a93e45a7c406cc2387dba1b44a9258bae6236fa7b781ee7758e3ac63bbf45
SSDEEP

24576:7p7C3c6H8re+rb6LRFbl5KPotfdGTZdMgtY+VTQC:7pAyrOLR9l5KYfkddMgtY+VTQ

Score

8^/10

execution

Malware Config

Targets

- Target
  
  970e42e01f0a5e0ae87a79fb209acae605eefa6c168c8008fbc9f544e405b683.exe
- Size
  
  819KB
- MD5
  
  12b9b84dad30fa72eb661f353b61e734
- SHA1
  
  4fd8377e65e1cafa730ddb07d99ba64774b979f8
- SHA256
  
  970e42e01f0a5e0ae87a79fb209acae605eefa6c168c8008fbc9f544e405b683
- SHA512
  
  39b7023a8174107ab77340bbec44cce8f047149acc9fa1bc520ce856433e2b5a4b2a93e45a7c406cc2387dba1b44a9258bae6236fa7b781ee7758e3ac63bbf45
- SSDEEP
  
  24576:7p7C3c6H8re+rb6LRFbl5KPotfdGTZdMgtY+VTQC:7pAyrOLR9l5KYfkddMgtY+VTQ
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2