e2a60dd19e8cf1808a1899b479993ec0371e3589f8f9800a179603c1439a3c7f | Triage

Resubmissions

04-10-2024 09:12

241004-k6awsszfjg 10

02-10-2024 16:19

241002-tshtxsyhrc 8

02-10-2024 15:59

241002-te38psvdmk 8

Sharing

General

Target

見積依頼.zip
Size

532KB
Sample

241002-tshtxsyhrc
MD5

4c6ca484315eb81d9d2acd8b45d9d1b5
SHA1

531944e322b496e83540e373bc0258573139ec96
SHA256

e2a60dd19e8cf1808a1899b479993ec0371e3589f8f9800a179603c1439a3c7f
SHA512

08e6520fdc2c58b4ea3ff65d3013652117d09fa78ecfe0253066928308463501694fe7c520cdecce528ef74747913e8460c6a9b20610fdb1d2586b5b8e34da53
SSDEEP

12288:ZFdHEdLT1FcxOAJBMkAPdKhlGxQR5vHs+tD+ImON+RYp5:Z7kdLTDuJqkmIhgiRftCIZ+45

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  見積依頼.exe
- Size
  
  618KB
- MD5
  
  d506d6578b57ed67971d049b10b8a2e2
- SHA1
  
  a58908b4c28b42d1f028466bfc6709a759304904
- SHA256
  
  89f6b4e8f4a3ec1fe146f806e4d4ba625a5d3e40d965018184a209d21721192a
- SHA512
  
  fc668df4a11cdf5a37e2bbfb672948b8b78fbc57ddeb5dd51ce2034343a0f1d35958ea2e8fddfc4f4aa5591590eeff04d120cac038ee83a7b12c4a57e0bf1c28
- SSDEEP
  
  12288:zLuWTG4mCjWA8oPPu8+FRgzYOivHm4o8b/wIVpGPEwkNB9Se:PNTChUu8AR1Q4Tb4IHNB9S
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution