General
-
Target
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
-
Size
708KB
-
Sample
241119-m7mcbsvlhy
-
MD5
3b5026bebf59332067171ff7a4039b4f
-
SHA1
d6258e9f95302f952455741777366c19ffe7d68c
-
SHA256
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
-
SHA512
b1f606bb64d52e22ffa6aadd904d68c964f06171677351d402689edaf7359148e964f89cc403414c3c3f81f93891c3d91cc9a3129a5042a25d1d4eceb21cf09f
-
SSDEEP
12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkR:6U/R16lEiPOScJAW
Static task
static1
Behavioral task
behavioral1
Sample
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
-
Size
708KB
-
MD5
3b5026bebf59332067171ff7a4039b4f
-
SHA1
d6258e9f95302f952455741777366c19ffe7d68c
-
SHA256
8d8c12c1b96b60a434c003d013e5bd8e948ea049246912b545fef1d3574819f4
-
SHA512
b1f606bb64d52e22ffa6aadd904d68c964f06171677351d402689edaf7359148e964f89cc403414c3c3f81f93891c3d91cc9a3129a5042a25d1d4eceb21cf09f
-
SSDEEP
12288:1S6E/s0yhD7tzPdEn7Nb+U2fljiBuRUVOScmGAltbkR:6U/R16lEiPOScJAW
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Accesses Microsoft Outlook profiles
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext
-