8300db5a6fe16d7fd304a550af51038a36ccd05dec58b98927007d77d842b508 | Triage

Sharing

General

Target

RG_925_073672_1819684_Komm_Bergmann.zip
Size

657B
Sample

240715-hpv5astdnq
MD5

65d4ee05d81cff42b19bab7652a74d3c
SHA1

01d0eb54c57bdc3c4c83d8e465eb3749f45dc2d0
SHA256

8300db5a6fe16d7fd304a550af51038a36ccd05dec58b98927007d77d842b508
SHA512

0f772d10f07a081b54c6bd46ee4364aa47dbd01d40b76f44987ae85696afb160b94f49f2b6fe92565981bd9da0817c8342142c1a7ce74703ef81053d8885bbe4

Score

8^/10

execution

Malware Config

Targets

- Target
  
  14124302182470515638.bat
- Size
  
  2KB
- MD5
  
  643b6da97b05489a08afea7e0e53baa5
- SHA1
  
  bc89db1f179fef0d87c53c26e70a0e23ae841659
- SHA256
  
  f08b16c5362221593ae7ff64668bfcafd2ea1f4a25099cb75151da907ebf18b2
- SHA512
  
  03b8182595fbda3840efe4359a18b10794de6c646c4b7bcf4617f1fadbcd5a1afdefda9e5446a0e01b756d6e1c6f9b08e2ae9eba339c1fa4c1ca12ac737ceac2
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2