80149457d49d4b0d60b473fe562fc102b186fe691dda4f8869f640d27ad4033a | Triage

Sharing

General

Target

80149457d49d4b0d60b473fe562fc102b186fe691dda4f8869f640d27ad4033a
Size

2KB
Sample

241119-xkv13azmdy
MD5

0e726ce306e8c5464d6208c4be48c13e
SHA1

6731929924e9e74783b2dc69ca325cc2d04733e4
SHA256

80149457d49d4b0d60b473fe562fc102b186fe691dda4f8869f640d27ad4033a
SHA512

09b5bc7d38ad3b8115cbd49ad114c3e26c5f1fd227bc69c833c01c3ca9e607b8760ddf786c2e52a2f668ea2d5bff8ab820367db43e463dc2936ac484527f53dd

Score

8^/10

execution

Malware Config

Targets

- Target
  
  80149457d49d4b0d60b473fe562fc102b186fe691dda4f8869f640d27ad4033a
- Size
  
  2KB
- MD5
  
  0e726ce306e8c5464d6208c4be48c13e
- SHA1
  
  6731929924e9e74783b2dc69ca325cc2d04733e4
- SHA256
  
  80149457d49d4b0d60b473fe562fc102b186fe691dda4f8869f640d27ad4033a
- SHA512
  
  09b5bc7d38ad3b8115cbd49ad114c3e26c5f1fd227bc69c833c01c3ca9e607b8760ddf786c2e52a2f668ea2d5bff8ab820367db43e463dc2936ac484527f53dd
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- An obfuscated cmd.exe command-line is typically used to evade detection.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2