Extracted

Extracted

• • Target

    f40405b25286ec40c39bfadf2e70ce5d102d4dd5a8309a5c1b7d1c710e1efb73.unknown

  • Size

    689KB

  • MD5

    8fd7c00084879a12a737d7ad5b3c18d8

  • SHA1

    ee92384a30a5765beacf8f902e22e99c9826b781

  • SHA256

    f40405b25286ec40c39bfadf2e70ce5d102d4dd5a8309a5c1b7d1c710e1efb73

  • SHA512

    814c7ef16ccf2cea69f3feed9d3bee085cc956e24f48893025f336ce1e7ee6cd945f468ebaa1f22021b8e08c862d2fbd288221f646e799689ad9e1bf758122d5

  • SSDEEP

    1536:VPPPPPPPPPPPPPPPPPPPPPPPE777777777777777777777777777777777777773:xJT0FT2U

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2