5d5b4f259ef3b3d20f6ef1a63def6dee9326efe2b7b7b7e474008aa978f1f19b | Triage

Sharing

General

Target

Captcha_V4ID882994ft.zip
Size

330KB
Sample

240929-jzhgmaybra
MD5

2076b25793d98bcff2169764b6cc33ee
SHA1

7ac453de02f20b8ba16786d244355946e9e93a6d
SHA256

5d5b4f259ef3b3d20f6ef1a63def6dee9326efe2b7b7b7e474008aa978f1f19b
SHA512

ad8a83813769401705d3c2696f97929ec79a42e463984975cb384e770673186a06b1fe707b5b72f8e382e045c35c91d16a535691d0cc8708f4d2ca8bcab88d98
SSDEEP

6144:BKGKpqSN+rRZgs3/O9MOdAPR1xDYgqHkFl3KuALYKfLFRLio:IB3N+r7g4GvdAPR1tkq3MLbfJR2o

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  Captcha_V4ID882994ft.bat
- Size
  
  441KB
- MD5
  
  5744e74d67f4cc91f262ddb95ac245a3
- SHA1
  
  890799de73d375478d3a5f0e2b86cec6a0585a91
- SHA256
  
  e726d3324ca8b9a8da4d317c5d749dd0ad58fd447a2eb5eee75ef14824339cd5
- SHA512
  
  9e30407dce840bb0c36b440b345572ba93bf7f9d2180b98255c371b2fc5d4289a27b74a9436148ff5448beb5f4d2160958625378122bad1920856b9da7807ea3
- SSDEEP
  
  12288:tAyShKVnHj+CoqBG+OlBn/ZGkQdLDLP4yLu:tnJh+cOn+LDLP5i
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecution