88f340643cb029167d027a28af60309f28ca5f11b55dd397795a5bcd442ab35d | Triage

Sharing

General

Target

88f340643cb029167d027a28af60309f28ca5f11b55dd397795a5bcd442ab35d
Size

80KB
Sample

241120-qp9lpaxhlj
MD5

40060de425545a1307eb02e2521c4b53
SHA1

686a4365ea6719d80d44a3514b821549527f4018
SHA256

88f340643cb029167d027a28af60309f28ca5f11b55dd397795a5bcd442ab35d
SHA512

c4c66735f7b935d4f8d88fe8e8e31ed4c2a129b6f35a15d8fe1df12d9e98c2a7bbac3763b0c0daae065747b80f21649c67af560a85e988e25d7773896bbea36f
SSDEEP

1536:ev128ZrmB+RdtK4QjXvquct+beug5VSM8E0kVva3DKD:y2OgTjg5VS5ko3DKD

Score

10^/10

collection discovery execution

Malware Config

Targets

- Target
  
  88f340643cb029167d027a28af60309f28ca5f11b55dd397795a5bcd442ab35d
- Size
  
  80KB
- MD5
  
  40060de425545a1307eb02e2521c4b53
- SHA1
  
  686a4365ea6719d80d44a3514b821549527f4018
- SHA256
  
  88f340643cb029167d027a28af60309f28ca5f11b55dd397795a5bcd442ab35d
- SHA512
  
  c4c66735f7b935d4f8d88fe8e8e31ed4c2a129b6f35a15d8fe1df12d9e98c2a7bbac3763b0c0daae065747b80f21649c67af560a85e988e25d7773896bbea36f
- SSDEEP
  
  1536:ev128ZrmB+RdtK4QjXvquct+beug5VSM8E0kVva3DKD:y2OgTjg5VS5ko3DKD
Score

10^/10

discovery collection execution
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Email Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

collectiondiscoveryexecution