Extracted

Extracted

• • Target

    84b91713ac74dfd54024b218dc6149cb60646018f70e4ee50e5038b84e43a70c.unknown

  • Size

    683KB

  • MD5

    89af3d1c013508a4c303b662082b37b5

  • SHA1

    27c09a549b4aa399d03440fc543fc72cea662231

  • SHA256

    84b91713ac74dfd54024b218dc6149cb60646018f70e4ee50e5038b84e43a70c

  • SHA512

    716a5bf5a788d976138dac3c7b7eb968fb4c20ec06bf45e2d0dfc99aa4f1594eb067285c2c0597999876067951627722634cc9fc243a3736e535a13c385569f6

  • SSDEEP

    1536:4vvvvvvvvvvvvvvvvvvvvvvvL88888888888888888888888888888888888888R:fvE

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2