d56216303dc8b6572d4ff2496631ab83f0d84494a59be81c5955ced018d8625c | Triage

Sharing

General

Target

d56216303dc8b6572d4ff2496631ab83f0d84494a59be81c5955ced018d8625c
Size

2KB
Sample

241120-e63c6awkdl
MD5

21fe76ab50f93aa41bec64fb9082f142
SHA1

70d5e284debb3694057b72da896b4ce01adc09f2
SHA256

d56216303dc8b6572d4ff2496631ab83f0d84494a59be81c5955ced018d8625c
SHA512

dd5e64315cae633223fd7787db0ebe6c1f610bfdd210b6d30ebf70eff234c9792806129ee0bc70736db1e44387be94710da0f8abfb73615c5b63e294c4481df8

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  
  d56216303dc8b6572d4ff2496631ab83f0d84494a59be81c5955ced018d8625c
- Size
  
  2KB
- MD5
  
  21fe76ab50f93aa41bec64fb9082f142
- SHA1
  
  70d5e284debb3694057b72da896b4ce01adc09f2
- SHA256
  
  d56216303dc8b6572d4ff2496631ab83f0d84494a59be81c5955ced018d8625c
- SHA512
  
  dd5e64315cae633223fd7787db0ebe6c1f610bfdd210b6d30ebf70eff234c9792806129ee0bc70736db1e44387be94710da0f8abfb73615c5b63e294c4481df8
Score

8^/10

defense_evasion execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Indicator Removal: File Deletion
  Adversaries may delete files left behind by the actions of their intrusion activity.
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

File Deletion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

defense_evasionexecution

behavioral2

defense_evasionexecution