3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb | Triage

Sharing

General

Target

3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb
Size

2KB
Sample

241119-nswswsvgqf
MD5

2657f1dbcdec15432bba4ed2ce54c990
SHA1

01bedae739a1f579472edd32250274bc2e218f9f
SHA256

3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb
SHA512

a4aecf01593d2efa8e1b9ce9411a41defdf189f32dd27ec1dd745d98ea96c66af5825949725954bb733c90f326c71baf6be645498d3173538c7407e177643e85

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  
  3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb
- Size
  
  2KB
- MD5
  
  2657f1dbcdec15432bba4ed2ce54c990
- SHA1
  
  01bedae739a1f579472edd32250274bc2e218f9f
- SHA256
  
  3e5fd9acdab438ffc8b2cce48c91679d3f980d08f9dea47d5e1039d352cd64fb
- SHA512
  
  a4aecf01593d2efa8e1b9ce9411a41defdf189f32dd27ec1dd745d98ea96c66af5825949725954bb733c90f326c71baf6be645498d3173538c7407e177643e85
Score

8^/10

defense_evasion execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionexecution

behavioral2

defense_evasionexecution