cf29786709d76a5015ff664a4263dfe200d04bd9686d45115660a83f82464c40 | Triage

Sharing

General

Target

Rechnung FV-UE24-243304068 von ALNOR CANDAN_O.zip
Size

1KB
Sample

240719-msg43axakj
MD5

f81807cd4d526521103d7785aa52c06c
SHA1

1b6f3074148d2b972986d7744b27d02cf9e5e007
SHA256

cf29786709d76a5015ff664a4263dfe200d04bd9686d45115660a83f82464c40
SHA512

1e9ecb4bbdc64714362488de55063ca073d5ad9bca271079c3d8aa84ba7b5962dc63d754ff07033e769063767f07fbf7f0e48b51132035a529500c515140eccb

Score

8^/10

execution

Malware Config

Targets

- Target
  
  2484229681190964219.bat
- Size
  
  2KB
- MD5
  
  e52b048bce665a27af65b0c8c4c83770
- SHA1
  
  dc1c7f5adf9c0802ceffd3a30f908779c190eb8f
- SHA256
  
  6a4c05e766919ee7adc57e649067a4258532b94d22210b6f4a7d47a73ef1b57b
- SHA512
  
  728f24ac99ff15296089422d3e1da452f5789670534fa8cb34b0494391f1a9b71b88850c8bd4244dacdf509ad3a79f36f7f90dcb08c72880cc46747d641a3fca
Score

8^/10

execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2