feb5cc842ec7a349c35cde346801179c8a94a40042f864af7ad7f67580182973 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

vorgang_875793.zip
Size

1KB
Sample

240719-h8dpcsscld
MD5

2e2fe842e30aa0e706e7cfa680aaf9a1
SHA1

c988736f201db53ffc8cca6dd26a81e126de9175
SHA256

feb5cc842ec7a349c35cde346801179c8a94a40042f864af7ad7f67580182973
SHA512

c889df99140d6592c307472a5ec49b6e33a470e4164c37d9ca0aa3322e1fd007503ed35a4db2ef432a8ad56fae960ce84e297af4dca0ae49a289dadc3296c826

Score

8^/10

execution

Malware Config

Targets

- Target
  
  872710821234617950.bat
- Size
  
  2KB
- MD5
  
  b4306fcc5e288271a3d8f695749264c7
- SHA1
  
  e0edf4253176410bc784c364f6548929e1a81fc6
- SHA256
  
  bf2f5248e84de5d990732f391cee59bbf478398adce87faab73958f251a3e4b2
- SHA512
  
  c8afab29943d40810124af58a15583cf904c2d4f7fa9dc7e3f6c1d0512968a84c81703afd74af1444fefa5513e9d1be7b2e8ad48307bd7b937ebd4fd3c8c2731
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2