a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526.bat
Size

2KB
Sample

240712-kybhcswgnk
MD5

c7cfa157c555fc50310608a516a337d8
SHA1

b4427847f0f0b46cd728373f2867f20ace446b49
SHA256

a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526
SHA512

eb87de6c4b37dc5c39fec9c970607e08f346acbf9df1e5f4db59b83a0bcb240a2361d779ca09a528c08a9d3476cab20e0b9d3df22f9d1ad66ac66655f93b2f36

Score

8^/10

execution

Malware Config

Targets

- Target
  
  a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526.bat
- Size
  
  2KB
- MD5
  
  c7cfa157c555fc50310608a516a337d8
- SHA1
  
  b4427847f0f0b46cd728373f2867f20ace446b49
- SHA256
  
  a354b20ff2e886390398f4179b1ba12f3cda99ed60d2b8f9dd0c5d2e06f5a526
- SHA512
  
  eb87de6c4b37dc5c39fec9c970607e08f346acbf9df1e5f4db59b83a0bcb240a2361d779ca09a528c08a9d3476cab20e0b9d3df22f9d1ad66ac66655f93b2f36
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2