Overview

overview

10

Static

static

3

fix.exe

windows7-x64

10

fix.exe

windows10-2004-x64

10

Resubmissions

21/09/2024, 21:27

240921-1aqkdavdqk 10

21/09/2024, 21:26

240921-1am49avcnh 10

21/09/2024, 21:24

240921-z85aravbpf 10

21/09/2024, 10:03

240921-l3p2zswhjn 10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fix.bat

  • Size

    3.3MB

  • Sample

    240921-1aqkdavdqk

  • MD5

    ab51a4a9922e4c4e6216285fd3a15434

  • SHA1

    e0909eadf961e0d79e4e3599367aaec51b903f40

  • SHA256

    754c21063bbd86f16a37b87733d6c419bc5eb6c6d72be6207fc2d430b71fa903

  • SHA512

    344d590d35c7d73ba23d56b244066755980c50dadd8e6d01b24cd06f724a4f8e52717feda21fdf42817d1aafb72e46ba2dddbe22e8582fd5d3a6b443c027448f

  • SSDEEP

    49152:IBJRJDgVBMbuO17NfdgZjjWTX61yxbFZ5tlYg+XQse4g+PSOQYvmnX+lLgRf:ydVuO17NfBTlZ5tl9wDPSOQYeOdgN

Score
10/10
discoveryexecution

Malware Config

Targets

    • Target

      fix.bat

    • Size

      3.3MB

    • MD5

      ab51a4a9922e4c4e6216285fd3a15434

    • SHA1

      e0909eadf961e0d79e4e3599367aaec51b903f40

    • SHA256

      754c21063bbd86f16a37b87733d6c419bc5eb6c6d72be6207fc2d430b71fa903

    • SHA512

      344d590d35c7d73ba23d56b244066755980c50dadd8e6d01b24cd06f724a4f8e52717feda21fdf42817d1aafb72e46ba2dddbe22e8582fd5d3a6b443c027448f

    • SSDEEP

      49152:IBJRJDgVBMbuO17NfdgZjjWTX61yxbFZ5tlYg+XQse4g+PSOQYvmnX+lLgRf:ydVuO17NfBTlZ5tl9wDPSOQYeOdgN

    Score
    10/10
    discoveryexecution

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks