fb6838cd85008793275e3152be63f6b14ec819c8bed0fb570b8ae3fe8ba072d2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

I01033740A5P46-copy.zip
Size

656B
Sample

240715-hf8c9sshkj
MD5

28c06b627fc11be21108836660427c52
SHA1

f3ac76ba9acb87538253b3026f6f0b87ec67b1f1
SHA256

fb6838cd85008793275e3152be63f6b14ec819c8bed0fb570b8ae3fe8ba072d2
SHA512

1f838c2e78efbb7866f64850502feef8ca95321009b80d5c44b18ac86f4fef7f0a4a928dc465d4185b1a46af7698a9e222c6dc84c923596f9a707c96307e6ae5

Score

8^/10

execution

Malware Config

Targets

- Target
  
  106288820130975804.bat
- Size
  
  2KB
- MD5
  
  18febc92432840d79e380da16d7c1189
- SHA1
  
  a6b993567b8baac28b7e5d4303af273d5d75e9d7
- SHA256
  
  fb0ddecff7e07e1598208065d14ec138abb72fc80882f7190af900a0278740c7
- SHA512
  
  f7aeac7e8e5f7dd6b8ee2ffeae36e318eacb53e560c6e0b8243a3b269ec25ecb6f21bc2811b506d01cfb64874b37e6e998b867fa7651642669b33966210363b0
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2