603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920.bat
Size

2KB
Sample

240713-mcw82sxalm
MD5

63522423029bfe28a9b54c7a9d527d89
SHA1

e57c43e41a73f02b7780c5af15cdd64c9e49410e
SHA256

603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920
SHA512

e821e0627f32b2fbf0f619c24f1f533f9ae2300348353ccc0bf63da926a6a3d38337eee9e264d8bca0c2321d7dd2d164a73f95f8c753d1a1765a6dca21ec35fb

Score

8^/10

execution

Malware Config

Targets

- Target
  
  603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920.bat
- Size
  
  2KB
- MD5
  
  63522423029bfe28a9b54c7a9d527d89
- SHA1
  
  e57c43e41a73f02b7780c5af15cdd64c9e49410e
- SHA256
  
  603b649826521ebbf7873a28b5a93db9dd5e8cd4cc3e12a52d0230799538d920
- SHA512
  
  e821e0627f32b2fbf0f619c24f1f533f9ae2300348353ccc0bf63da926a6a3d38337eee9e264d8bca0c2321d7dd2d164a73f95f8c753d1a1765a6dca21ec35fb
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2