19fb3108a5c7a3bc2694062805359f555450524a6fbf1eba7c30a544e1749f94 | Triage

Sharing

General

Target

recaptcha-verify
Size

2KB
Sample

250120-vm7frszmcz
MD5

0b7e92d23c4b2765b641fa4236564270
SHA1

d1763d696b8e530c8f29026ba0f3278c77660f26
SHA256

19fb3108a5c7a3bc2694062805359f555450524a6fbf1eba7c30a544e1749f94
SHA512

5ac9164afbff95b0ecf3e782037983736a93017d10b7564239bae0b3002d5be18401102a05e1e031c75198e35b08463b1a729482ddffcd4144546092ef36fb13

Score

8^/10

google discovery execution phishing

Malware Config

Targets

- Target
  
  recaptcha-verify
- Size
  
  2KB
- MD5
  
  0b7e92d23c4b2765b641fa4236564270
- SHA1
  
  d1763d696b8e530c8f29026ba0f3278c77660f26
- SHA256
  
  19fb3108a5c7a3bc2694062805359f555450524a6fbf1eba7c30a544e1749f94
- SHA512
  
  5ac9164afbff95b0ecf3e782037983736a93017d10b7564239bae0b3002d5be18401102a05e1e031c75198e35b08463b1a729482ddffcd4144546092ef36fb13
Score

8^/10

google discovery execution phishing
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Detected potential entity reuse from brand GOOGLE.
  phishing google
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

googlediscoveryexecutionphishing

behavioral2

googlediscoveryphishing