8d137964104040af220765f8c8436c4143317c6f69589ed4556e344663b5c518 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

29172230642728725035.bat
Size

2KB
Sample

240713-hdzncazdqr
MD5

1d440327954dfe23e0e8df86563d758e
SHA1

fe2659d18e10337b0a0812e15c0882f0a158a35c
SHA256

8d137964104040af220765f8c8436c4143317c6f69589ed4556e344663b5c518
SHA512

711fabda55d17f78cd3a2abc6225028c2b37cb14c7ee9dec6fe5da9a89fcea76e84eb23e579cf5b40901ea25646d87c4066ddcec1131dbe8b97b970f7daa1737

Score

8^/10

execution

Malware Config

Targets

- Target
  
  29172230642728725035.bat
- Size
  
  2KB
- MD5
  
  1d440327954dfe23e0e8df86563d758e
- SHA1
  
  fe2659d18e10337b0a0812e15c0882f0a158a35c
- SHA256
  
  8d137964104040af220765f8c8436c4143317c6f69589ed4556e344663b5c518
- SHA512
  
  711fabda55d17f78cd3a2abc6225028c2b37cb14c7ee9dec6fe5da9a89fcea76e84eb23e579cf5b40901ea25646d87c4066ddcec1131dbe8b97b970f7daa1737
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2