399b9d5f1658e0050f4861e992ce7648ed78f8da0b9c7789da902550e7513884 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

399b9d5f1658e0050f4861e992ce7648ed78f8da0b9c7789da902550e7513884.exe
Size

903KB
Sample

241015-bp32kszgpm
MD5

8cba5bb31885648fd1021bf21eb5b790
SHA1

f16e0fb600d331fcb40d7aa52a718d1de895d3c4
SHA256

399b9d5f1658e0050f4861e992ce7648ed78f8da0b9c7789da902550e7513884
SHA512

a299127aefa624c4b8f403da79178582c752b3fe7dfcbf10e9ef8b265a3afad935cb137af218a4dc78e98e78eedd0880bd28f16964eea5c7e6698d31f4cbdc01
SSDEEP

12288:0DtN59USZSFO01+vMXbS0MRK3zSjKUJgKbCJb8ZNa2HWCqcYRF8rHFlSmVhCpHPW:OxZSPqSSF+cVZywHj3hCxGnfT

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  399b9d5f1658e0050f4861e992ce7648ed78f8da0b9c7789da902550e7513884.exe
- Size
  
  903KB
- MD5
  
  8cba5bb31885648fd1021bf21eb5b790
- SHA1
  
  f16e0fb600d331fcb40d7aa52a718d1de895d3c4
- SHA256
  
  399b9d5f1658e0050f4861e992ce7648ed78f8da0b9c7789da902550e7513884
- SHA512
  
  a299127aefa624c4b8f403da79178582c752b3fe7dfcbf10e9ef8b265a3afad935cb137af218a4dc78e98e78eedd0880bd28f16964eea5c7e6698d31f4cbdc01
- SSDEEP
  
  12288:0DtN59USZSFO01+vMXbS0MRK3zSjKUJgKbCJb8ZNa2HWCqcYRF8rHFlSmVhCpHPW:OxZSPqSSF+cVZywHj3hCxGnfT
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution