8b528f3a173e7e40394c21bb0cfa0304ef12b58ab185de1da8e4b4e5231eee8a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

PURCHASE ORDER-6350.exe
Size

831KB
Sample

241003-ljrfpszcke
MD5

580cd9b274ea0351f4464bea51560e87
SHA1

84d3a301f50ec248d1209bfb0ecaf98eb329a9aa
SHA256

8b528f3a173e7e40394c21bb0cfa0304ef12b58ab185de1da8e4b4e5231eee8a
SHA512

2798587540ce8b78ba6a64b0d4635ae517879e1ef742506acf74c16fb77555fd3b701a3a290be5123ec32c39b66353494588157e965f9a2a51fe53ff65fcab1e
SSDEEP

12288:32M44SGRPuRKJU/A46eaIZBJBgaP6ubf6wnaLGCTxuKci/7N5:C9uPucK16Eo66uD6wyFuM7N

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  PURCHASE ORDER-6350.exe
- Size
  
  831KB
- MD5
  
  580cd9b274ea0351f4464bea51560e87
- SHA1
  
  84d3a301f50ec248d1209bfb0ecaf98eb329a9aa
- SHA256
  
  8b528f3a173e7e40394c21bb0cfa0304ef12b58ab185de1da8e4b4e5231eee8a
- SHA512
  
  2798587540ce8b78ba6a64b0d4635ae517879e1ef742506acf74c16fb77555fd3b701a3a290be5123ec32c39b66353494588157e965f9a2a51fe53ff65fcab1e
- SSDEEP
  
  12288:32M44SGRPuRKJU/A46eaIZBJBgaP6ubf6wnaLGCTxuKci/7N5:C9uPucK16Eo66uD6wyFuM7N
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution