da49af2a2d80b99aa1c0ed5519e0f784761d1e718b1144fe634be7891fb53101 | Triage

Resubmissions

21-10-2024 03:43

241021-d985fawgqf 10

21-10-2024 03:40

241021-d8cd3swfre 8

Sharing

General

Target

お見積り依頼.r00
Size

535KB
Sample

241021-d8cd3swfre
MD5

0cc1ed940e513e9ba1bccadd9006954f
SHA1

3461be1bed20608db07e6311053ff5fd26f462df
SHA256

da49af2a2d80b99aa1c0ed5519e0f784761d1e718b1144fe634be7891fb53101
SHA512

4809e5cd2f8d7229385e8be6c128afc28f1d4c3a044c7c72283d7786a776002e41a41582c269b1a786588a2eecaa2e2de159de77c752325913d84225553f709d
SSDEEP

12288:NEmAxFBcr0zEtvEQ6hZfNPhqOMEmUzw/hSCsjuBT736kncQnK56LeIbBYn:NkFzZQ6p8OMEmUs/4juh7cCXFq

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  お見積り依頼.exe
- Size
  
  560KB
- MD5
  
  80b56ae302fea7f0f9e00b63f7ad598b
- SHA1
  
  6411184877abfdd8b7743c27ef94e0f257ce1f1d
- SHA256
  
  82c8e9440da130cb3c991bfd2b98afbf11fff2be9acd3e56b3107096a11a69e6
- SHA512
  
  b08b31671c258ad4d9be77f88e91cecc80ed5e8d0331b8cc4f3cb2af0e130a2b937d74a628d6681125d48581c6743a1d852b5a1143c66c298d54c8e88a369528
- SSDEEP
  
  12288:/fATXkhMOoltiJVsxIojON7X4ETsCh/YvMLPVycMnt+giaS1P:Ckh5oDiJexpirB5ybt+8SB
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

discoveryexecution