baf3cf480bf1c409ce3c9cbb139ba4bb8f70de0df0430d7d733f8b0f3a65e7ac | Triage

Sharing

General

Target

2024-09-15_e13df6706bc492838bdd1ff9f8d814d6_mafia
Size

184KB
Sample

240915-l97klsyhjr
MD5

e13df6706bc492838bdd1ff9f8d814d6
SHA1

f271e68e4a4d42e016def4bf3771e9d6033fcf68
SHA256

baf3cf480bf1c409ce3c9cbb139ba4bb8f70de0df0430d7d733f8b0f3a65e7ac
SHA512

6b586b9ad7b176a8f336872ee202d141804490a92591328a0edd53dc943e50c5af6084bb7f773d6eb9b465459076b9c3521a5d42a80f4bfce56cd2943724fb9a
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3q:/7BSH8zUB+nGESaaRvoB7FJNndnX

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  2024-09-15_e13df6706bc492838bdd1ff9f8d814d6_mafia
- Size
  
  184KB
- MD5
  
  e13df6706bc492838bdd1ff9f8d814d6
- SHA1
  
  f271e68e4a4d42e016def4bf3771e9d6033fcf68
- SHA256
  
  baf3cf480bf1c409ce3c9cbb139ba4bb8f70de0df0430d7d733f8b0f3a65e7ac
- SHA512
  
  6b586b9ad7b176a8f336872ee202d141804490a92591328a0edd53dc943e50c5af6084bb7f773d6eb9b465459076b9c3521a5d42a80f4bfce56cd2943724fb9a
- SSDEEP
  
  3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3q:/7BSH8zUB+nGESaaRvoB7FJNndnX
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution