Extracted

Extracted

• • Target
    84b91713ac74dfd54024b218dc6149cb60646018f70e4ee50e5038b84e43a70c.unknown
  • Size 683KB
  • SHA256 84b91713ac74dfd54024b218dc6149cb60646018f70e4ee50e5038b84e43a70c
  • MD5 89af3d1c013508a4c303b662082b37b5
  • SHA1 27c09a549b4aa399d03440fc543fc72cea662231
  • SHA512 716a5bf5a788d976138dac3c7b7eb968fb4c20ec06bf45e2d0dfc99aa4f1594eb067285c2c0597999876067951627722634cc9fc243a3736e535a13c385569f6
  • SSDEEP 1536:4vvvvvvvvvvvvvvvvvvvvvvvL88888888888888888888888888888888888888R:fvE
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2