d78e7c0d9e50043400028a135bbaac89a51400e93e60b4b648172f02ecb7e4e8 | Triage

Sharing

General

Target

d78e7c0d9e50043400028a135bbaac89a51400e93e60b4b648172f02ecb7e4e8
Size

2KB
Sample

241120-f2exqswqdk
MD5

8a131467d9e8042496ee3fca5204dd38
SHA1

6b2466b6d395bd4ea9127c5a3597b27cfd7b0fe2
SHA256

d78e7c0d9e50043400028a135bbaac89a51400e93e60b4b648172f02ecb7e4e8
SHA512

d5fa629eb555c10c77712516f74917fe5dba3af366b000be823348beaa87cf52edfcbf20edd568f47ee9cf304f23d2433884ff40b362b3990f5369bf77423669

Score

8^/10

execution

Malware Config

Targets

- Target
  
  d78e7c0d9e50043400028a135bbaac89a51400e93e60b4b648172f02ecb7e4e8
- Size
  
  2KB
- MD5
  
  8a131467d9e8042496ee3fca5204dd38
- SHA1
  
  6b2466b6d395bd4ea9127c5a3597b27cfd7b0fe2
- SHA256
  
  d78e7c0d9e50043400028a135bbaac89a51400e93e60b4b648172f02ecb7e4e8
- SHA512
  
  d5fa629eb555c10c77712516f74917fe5dba3af366b000be823348beaa87cf52edfcbf20edd568f47ee9cf304f23d2433884ff40b362b3990f5369bf77423669
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2