General
-
Target
download
-
Size
67.1MB
-
Sample
240925-mah9eazdjk
-
MD5
7d658964c1874ca902f3dc0864b00a3c
-
SHA1
c972667622f44e4cb93a2fc7d9f1a0dc1cbb5edf
-
SHA256
100565864eed928d474d1912b9de2f124a2e94f312a454922b4ccdff36860fba
-
SHA512
28adf2797b6acc971d67f75bc2c8ea90693c68e62732f1f5986561b0b9bfc60d0ca4495f6547057a046286328c6a25268c07aadbe5cdacf246ddbbb0c8de086f
-
SSDEEP
1572864:AK93N+NLkIzv7Bc6hrd3L/HGuIa31UwAQEKhSzqYA8nfndf:AU9+NC69N/muIq1ULQE4SpFf
Static task
static1
Behavioral task
behavioral1
Sample
download.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
download.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
download.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
download.exe
Resource
win11-20240802-en
Malware Config
Targets
-
-
Target
download
-
Size
67.1MB
-
MD5
7d658964c1874ca902f3dc0864b00a3c
-
SHA1
c972667622f44e4cb93a2fc7d9f1a0dc1cbb5edf
-
SHA256
100565864eed928d474d1912b9de2f124a2e94f312a454922b4ccdff36860fba
-
SHA512
28adf2797b6acc971d67f75bc2c8ea90693c68e62732f1f5986561b0b9bfc60d0ca4495f6547057a046286328c6a25268c07aadbe5cdacf246ddbbb0c8de086f
-
SSDEEP
1572864:AK93N+NLkIzv7Bc6hrd3L/HGuIa31UwAQEKhSzqYA8nfndf:AU9+NC69N/muIq1ULQE4SpFf
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Adds Run key to start application
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1