071bda42c9cdb2c15557584e915acbe17d6d7f0590a38d1d584c9b369945d11f

General

Target
document.zip
Size 2KB
Sample260707-pd732sew4l
SHA256 071bda42c9cdb2c15557584e915acbe17d6d7f0590a38d1d584c9b369945d11f
MD5 4fce0f19f18dff0bc15e47fcd6872849
SHA1 791c0b75a2e56494e193d5981f807e8696226409
SHA512 c90fb84009a4c7db3402b877a2f0c7549f63ad460ebcbb31b2ed68ebd93f3de8c74a1cf95332e463e48bb5dedc3b17be32ffe8af8b6c3448e6c8d69c81eb0e04
TLSH
T1DE511A71DC2E0662DD0A61711AB94D4DB479D92AD98209950218A7880B8E9E019BCDC5
MD5 SHA1 SHA512 TLSH

Score

8^/10

Malware Config

Targets

- Target
  ReadMe.txt.lnk
- Size 1KB
- SHA256 868fce76bfc864504b9e2eba51fb7ac02b0b8e1888c4ab59d29330ed3137d6e3
- MD5 b50b939ffacf6f6ee93cc215a84fc41c
- SHA1 f72438e8a108133f8959c37a720838a826c2b619
- SHA512 5ccf8a85b9d25856e4acdbd3ec0f5430cc20d2e511ceea8d4177f263b25f97dd6df4f77e7c6282a933349463b6bc13c075f4dd71bfbc7cb776f952cc2efbb90d
- TLSH
  T14831C00177E50624E7B28A36587AE2018D32BD16AD62CF6D45D0914C5C21A50FC75F77
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral1 behavioral2
- Target
  document.pdf.lnk
- Size 2KB
- SHA256 2b8c10ee1962740a3a48e37654bf0d418476a2877c147c7bcfb787a2445ff883
- MD5 dae2a3ab13b0c08b5140c8ee5b1dd48e
- SHA1 c3cd41c0ff928aa8eff8d3c96b45d152b4b022ae
- SHA512 759ac1a60cdeb60460f4d0eb545748ff1f946766d0c7d4df0243e653ff9c15c0a617cd118308f3796fc13a3f01c5db8b675aa65a41b42057345c6bb6ae912a42
- TLSH
  T12151420873E98235E7B68A376DBAE2104831FD16AE22DF6E05C4564C6C22610FC35F77
- MD5 SHA1 SHA512 TLSH
Score

8^/10

discovery execution persistence adware spyware
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
behavioral3 behavioral4