146a8d7688a8682f74040e955a8b400a8f570a01aa65c958ad4b28ee38f9e223 | Triage

Sharing

General

Target

146a8d7688a8682f74040e955a8b400a8f570a01aa65c958ad4b28ee38f9e223.exe
Size

742KB
Sample

240612-smaqpatcqk
MD5

bef4caab044df2935d55a1b3ae775bef
SHA1

3c2811cef28d71cde45e04aac5cee73a553b076f
SHA256

146a8d7688a8682f74040e955a8b400a8f570a01aa65c958ad4b28ee38f9e223
SHA512

a15ec298b68182cbba9865c4a4a0a589555c2572a178e81b23fbc9863a6f3b3a39f2e005cba78b9a0ec12689b39b2e7d398c19caf8f36c43e03d5670ee331e6c
SSDEEP

12288:NX0px4V36Di8BtLV9azvF4rDL19zGN4epygH4vJwOqw/Z4+OPqllXll7nGVW8svp:5BFK8WDL19ferNTsvzxKvCP/z

Score

8^/10

execution

Malware Config

Targets

- Target
  
  146a8d7688a8682f74040e955a8b400a8f570a01aa65c958ad4b28ee38f9e223.exe
- Size
  
  742KB
- MD5
  
  bef4caab044df2935d55a1b3ae775bef
- SHA1
  
  3c2811cef28d71cde45e04aac5cee73a553b076f
- SHA256
  
  146a8d7688a8682f74040e955a8b400a8f570a01aa65c958ad4b28ee38f9e223
- SHA512
  
  a15ec298b68182cbba9865c4a4a0a589555c2572a178e81b23fbc9863a6f3b3a39f2e005cba78b9a0ec12689b39b2e7d398c19caf8f36c43e03d5670ee331e6c
- SSDEEP
  
  12288:NX0px4V36Di8BtLV9azvF4rDL19zGN4epygH4vJwOqw/Z4+OPqllXll7nGVW8svp:5BFK8WDL19ferNTsvzxKvCP/z
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2