Overview

overview

8

Static

static

3

BL-INV-PL-ISO.exe

windows7-x64

8

BL-INV-PL-ISO.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6e2e1eab81dbd88feb2e6f19d7923e2bc0e1ea99c12849d4a2b832bee1e21452.rar

  • Size

    696KB

  • Sample

    241002-bqbzgszekm

  • MD5

    9638fc217acabecaa3eef4717c7a06c9

  • SHA1

    e98be6e9588e7a5f8d894b0b1bd27a712e85f1b3

  • SHA256

    6e2e1eab81dbd88feb2e6f19d7923e2bc0e1ea99c12849d4a2b832bee1e21452

  • SHA512

    464b9566a2d93cebee9d31d4e46d784765437e9e4e640691a78a78c20e1482d4ce8074f4a90efd2b1b56f934c0291dce4903865c28e3aad5a67ebbdc96931ee4

  • SSDEEP

    12288:vA6VxdsLgH2xrNm01o9xzMZ3P1T1fzd7t2j0QYeyAiJkNb:vXdsxxrNtGxgZf1hRS0LAiiNb

Score
8/10
discoveryexecution

Malware Config

Targets

    • Target

      BL-INV-PL-ISO.exe

    • Size

      813KB

    • MD5

      98764b1ea06180b4a89c043b0fc11914

    • SHA1

      88cdfcf42452ca0429f31fdd8d7372effe387969

    • SHA256

      97fb0388618e3d977b390696f4ca19e38f0e706d70a40726bab9ed8dcdcd036c

    • SHA512

      3d394a5887178f60c6c92f1790314812fe8d13fb0811baeeb7f526eab7bd9f548f9ae8c171361430743efc06ca476145cb53821258fe1cea8d353cdbf87a0211

    • SSDEEP

      12288:M1ZF8Km3Tsu+N7PB6cDS9YGFuzM4DrGUS6ZbxksCsJSxaV5+prfHha9:Mygu2Qc9GwMArGUZZbxksCs9+hfHha

    Score
    8/10
    discoveryexecution

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks