901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983 | Triage

Sharing

General

Target

901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983.exe
Size

773KB
Sample

241120-djpccaygle
MD5

07c670db42c6dd91d44fba526b66fe3d
SHA1

008b4763024b2a6a2da1aaac4ae3adf318aad1dc
SHA256

901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983
SHA512

12b4169add474c540daab69ba5cd414ae70874bae835cd82b291fd1367364ffed23884d04d76998ff143b5dedffcb12242d420d1ce2af388ad51ece99b8e2fbc
SSDEEP

12288:Z6IMWhI78ZWcPiGEzN6kbJaHfevkexYpe1iSJRHIvVTETlZQPS2KmyRjvekR:qv7OpPNOb0mse6e1nJRHIvVT3y9

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983.exe
- Size
  
  773KB
- MD5
  
  07c670db42c6dd91d44fba526b66fe3d
- SHA1
  
  008b4763024b2a6a2da1aaac4ae3adf318aad1dc
- SHA256
  
  901f5ee695e32164bd5fa37b4d6ee86680c435aafdb9d504864b5d70d3da9983
- SHA512
  
  12b4169add474c540daab69ba5cd414ae70874bae835cd82b291fd1367364ffed23884d04d76998ff143b5dedffcb12242d420d1ce2af388ad51ece99b8e2fbc
- SSDEEP
  
  12288:Z6IMWhI78ZWcPiGEzN6kbJaHfevkexYpe1iSJRHIvVTETlZQPS2KmyRjvekR:qv7OpPNOb0mse6e1nJRHIvVT3y9
Score

8^/10

discovery execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

Persistence

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Scheduled Task/Job

Scheduled Task

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution