c5a7fe68a3b672fb8b0bfc5a3e5fd77b5fa5f4e5c03a14515f91d1720136f58f

General

Target
Nro. 20011415515920261882640 – EMPLAZAMIENTO; Despacho_ Juz. 2° Laboral Cto. - Aguachica _ Aguachica - Cesar
Size 11.6MB
Sample260707-vdh2taay8p
SHA256 c5a7fe68a3b672fb8b0bfc5a3e5fd77b5fa5f4e5c03a14515f91d1720136f58f
MD5 d6f744cca9af5c5b722a4d5e6aead7be
SHA1 edfab81dc46551c8a3a47fe0fce00bbd9b8ea864
SHA512 360c1dc3a241df36b1c20314d778d14f9acc426cf3d8ac07c6ac94429b7e3b6a363821b94debde690cae5323890d734164493113f0b3a2498fb6226bff91512c
SSDEEP 49152:INAreXR0x6QQ6k2QUaOlRBim4jMJY4PGs7ljEtbHGU8FsKhXl7Tdr6FRy6xGc0YP:INF
TLSH
T183C64CE337DF6A4B5905735AE40D295C0F6AD5311E83EBE894D70BD8140F88A2AD0DAF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Nro. 20011415515920261882640 – EMPLAZAMIENTO; Despacho_ Juz. 2° Laboral Cto. - Aguachica _ Aguachica - Cesar
- Size 11.6MB
- SHA256 c5a7fe68a3b672fb8b0bfc5a3e5fd77b5fa5f4e5c03a14515f91d1720136f58f
- MD5 d6f744cca9af5c5b722a4d5e6aead7be
- SHA1 edfab81dc46551c8a3a47fe0fce00bbd9b8ea864
- SHA512 360c1dc3a241df36b1c20314d778d14f9acc426cf3d8ac07c6ac94429b7e3b6a363821b94debde690cae5323890d734164493113f0b3a2498fb6226bff91512c
- SSDEEP 49152:INAreXR0x6QQ6k2QUaOlRBim4jMJY4PGs7ljEtbHGU8FsKhXl7Tdr6FRy6xGc0YP:INF
- TLSH
  T183C64CE337DF6A4B5905735AE40D295C0F6AD5311E83EBE894D70BD8140F88A2AD0DAF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10

adware spyware
behavioral1 behavioral2
- Target
  avaluo_edicto.6796871-Incidente.xhtml
- Size 8.4MB
- SHA256 c87bca25ab7f7a5a573ca5a0c7e6b133504fdefff0d66b88af1ef5fd80e53659
- MD5 75ab550fffeff7f218dff632abb89080
- SHA1 ec835e01df1074927d88e7916dc807ce55235753
- SHA512 8fa9a2e709035b672edefd88ba4e1c99fb720317446ce658818fdfba8c80d2fa87585bda1654458f20880fe7b83aa8ea1abbdc02391124f1256bb85afe883b1a
- SSDEEP 24576:sXZZXhZw6PdpXEkaYpNb0Fu4pRIVA2A5GN69AAepl+zSKmcd6dVXFOwjw+WlMREv:WZXvzXNvuScGN6FsdVXruMRq
- TLSH
  T1C296C0BC75085CF91A5F1677DDAA6ADA1BFA0B738A4BA4C9811177C3057337AEE01C08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution persistence trojan
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- UAC bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
- Suspicious use of SetThreadContext
behavioral3 behavioral4
- Target
  email-html-2.txt
- Size 12KB
- SHA256 f677e5aa1bbb6a1eea8308675b35ed52d27483896a91c8ad5e60f2cf24d52614
- MD5 c2d9b3dcc17accd3ad470ae95769f8b6
- SHA1 9a0ec44300676022089808d446465846c75c55bb
- SHA512 05833533ea7e76f91bac5ea5b3760ff68768060463233287fbf131fd36781d829855805a0b14ac703448c6411dbceb91f7393acccdf21cb2e95a7b9a7be869e9
- SSDEEP 192:Px2PUx2Sx2Bx23Bx2QGx2Hc3Bx27PMAg+Q3:J7BmOTc8c3TRAgH3
- TLSH
  T11442B417F3C019159A9F8920A543777E7F3C81DA9F264934A9CB6B3D0B4CCE386C5689
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

discovery
behavioral5 behavioral6