12cdb45cbde5f8d2ee37b287d91d68f1c71ad7a8e343c144ae2d24f3e9a0d955 | Triage

Sharing

General

Target

2024-09-19_ea4c72504f6f57fa03108801fa104aa3_mafia
Size

184KB
Sample

240919-rgshwashqk
MD5

ea4c72504f6f57fa03108801fa104aa3
SHA1

472923bbcaf4857f3259779a5847ffaf0edd4fdf
SHA256

12cdb45cbde5f8d2ee37b287d91d68f1c71ad7a8e343c144ae2d24f3e9a0d955
SHA512

e7d1066ee49f2a7e30e262d95524bba508ffc819d2874fbdd137dbb52fd64542450b2792c032b619e88f73abe86dc862a75be54c08243d99652f1aa074136ded
SSDEEP

3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3sMV:/7BSH8zUB+nGESaaRvoB7FJNndnLY

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  2024-09-19_ea4c72504f6f57fa03108801fa104aa3_mafia
- Size
  
  184KB
- MD5
  
  ea4c72504f6f57fa03108801fa104aa3
- SHA1
  
  472923bbcaf4857f3259779a5847ffaf0edd4fdf
- SHA256
  
  12cdb45cbde5f8d2ee37b287d91d68f1c71ad7a8e343c144ae2d24f3e9a0d955
- SHA512
  
  e7d1066ee49f2a7e30e262d95524bba508ffc819d2874fbdd137dbb52fd64542450b2792c032b619e88f73abe86dc862a75be54c08243d99652f1aa074136ded
- SSDEEP
  
  3072:/MzsU0S0w8Hp9Rc/LB+dJGESR4hIRSYaVvb1NVFJNndnO3sMV:/7BSH8zUB+nGESaaRvoB7FJNndnLY
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution