d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab

Sharing

Copy URL Twitter E-mail

General

Target
ProtokolZatrimannya.zip
Size 104KB
Sample260712-ntmllsg15m
SHA256 d448dfee940f4cbb2c26702951998ebeda7d24f137047a10ea8fbcbb6a903fab
MD5 d7dd5ca239dd204fe8a51215028b9bd1
SHA1 ef762657a3de5ab8632d13691592f5b86cda9c77
SHA512 1a01176ee89e846ac81c364c0b633cf8d38fb4a12f73d0869d45b8a9c12e1cbaf8f71071bc072aa10215b371e3253b3205b81d507e744ef4ec1e247657672c1c
SSDEEP 192:3cc5C3gfZJr5Gc5wjD9IurjD9IMcIAzPucB/CRc7dTXB2JD:3cc4QfZJr5GcuP9cIGuc5yc5TXB2JD
TLSH
T1A1A3103475D81019E1F3EF72ACF477C5AEABF677B9B2125D1850160A4912E80EE12B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Targets

- Target
  ProtokolZatrimannya.docx.lnk
- Size 19KB
- SHA256 c783aca3fd2464568bf416912bd0f052d15278910b97025edea67e770308ecbf
- MD5 9b9ee0a683838f16f71497b6f7addb58
- SHA1 016cd83d8d13d5c7c0e0016f1cc380e416a4c5ff
- SHA512 97a713d563e67eb5fd655222ee39f2b14e224d5717aa479e017f428a0aa1aac6529b7fd34bf6d7bf2e511e75cf255c411c1a8fec2eafdeeb2c18e3cc2fb99551
- SSDEEP 24:8d/anMfCJU6yaWInZViOSp+UOi+Eu+njVHqcVSWKMSS81W:8lanMrXanfy7KEu+njtlVSWK511W
- TLSH
  T1A092BB3475E9011AE1F3EE716DF477C5AEAAF277E871128D454402094912E80FD53B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral1 behavioral2
- Target
  ScanPassportiv1.pdf.lnk
- Size 16KB
- SHA256 119a7ff8088bba7861ccd0dc9ba96a144636c692ff63acfd95db62527f5f4e75
- MD5 8e8db244348ae44705260b51edfd1e60
- SHA1 00e2d70ac34f323a74320c37a18aa040e9173ffd
- SHA512 49562dbc4bcd6b3cf80a636b5483ac720b7c9b9de3be65e3bd726ce60a4e92342343883ec06f33d0629f526554e934c8ae01aab1f7bab84aaa3e83cdff2f085f
- SSDEEP 24:8d/anofC4X6yaWInZfsmSp+UOi+Eu+njVHqopuzZMT/Oz:8lano1XanGmy7KEu+njt3K
- TLSH
  T17472773438E90129E1F3EF716DE467C5EDAAF277A871268D4545120A0912E80EE63B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral3 behavioral4
- Target
  ScanPassportiv2.pdf.lnk
- Size 15KB
- SHA256 e785fef4921541ae0c2da3b350a489d0c2290377b56a4890d7cf78ada4f263e6
- MD5 a7ed723984e6417a45ad5756ebcd0c5b
- SHA1 2250cf70af60c3349b2c2691f63cb08cfd80aeb1
- SHA512 64249121f28728f16f236e01fada3f60a8f254cfc5a126b6190a173891dcf4cd2b62a775111aac341ac0204361090eed0b426394aef6d01da6fe046c788a0245
- SSDEEP 24:8d/+pKvjDRL5BvyJveJFyaWInZL6br71WOHmnTZzs+m9lnWKmM5EF:8l+pKvjDRzvyJveWanwbrJHHmtu9lW9
- TLSH
  T1C472AD3479ED0219D2F3EFB2ADB876D59E9BF67338B1065DA481020E4911E40EE5273A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral5 behavioral6
- Target
  ScanPassportiv3.pdf.lnk
- Size 16KB
- SHA256 fd53fe5d08d31903ea018c27668eb85e529ce6e30573b8e41a8f7d7c6869cc66
- MD5 0d078913b768c65a51aa8e80fb09ef95
- SHA1 e0c980164f1973c4cc3af71a0ef225402eca9361
- SHA512 b061751e8af727b8f41c51e3126d64a34ce87416eaf25143aad977ddd85de5f4e911d2ad247430efba6c2b2df7e35aee3bbb510ac1784cdf6376a5e054faea34
- SSDEEP 48:8l+pKvjDRzvyJveWanRANE+L7C9bAzy5:8DjDRbyheWyRzcUbAzy
- TLSH
  T18072DB3435EA0145E1F3EB31ADF8B7C19E9BFBB375B1419A2081520E4911980ED52B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral7 behavioral8
- Target
  ScanPassportiv4.pdf.lnk
- Size 16KB
- SHA256 9262d422a88e1613a6bec489aa93411e64ba976cd2a0596339513a4a7ce3cf79
- MD5 3d069e5cfa5b789e1ce23502ec219031
- SHA1 24030fb0b453048c5fde006ec68831d3ae41def7
- SHA512 3a2eed43aa4b7cd7ea591bf5598b8f6f18ba2f725e5f8278158bcdebf03f2f36e357bf47dc3b1735254a881b847d57effecc5dc3c9fdc1164cbdc4910c895a2c
- SSDEEP 24:8d/NizPdHyaWInZaSp+UOi+Eu+njVHq6EMlU:8lNizcan0y7KEu+njtPE
- TLSH
  T10D72D03434EC0129E0F3EE716DF467D5AE9EF977A8B1119D584112064912E80FD13B3B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral10 behavioral9
- Target
  SpisokZatrimanih.xlsx.lnk
- Size 19KB
- SHA256 12effef59a3c09f6dc304a8f927e8afe03873915da2df5f761c321f19e6161b9
- MD5 7a6d03eb8863ccf9ce0ce905db53e9a2
- SHA1 0d3e0d5cb442cb3c2358ed2605d902c97ab157a3
- SHA512 a6562350fa6426458fbe328338044921e71acd7fa2862cfe2cd4f8d702016230ca1462b77414f1cb7fcefad577ac904d1b16f36c5e3a93d14b62d3873707334f
- SSDEEP 24:8d/NiWNPy/RyaWInZjllSp+UOi+Eu+njVHqkvMqkE:8lNiU6/gandlly7KEu+njtVv1
- TLSH
  T18D92BE3435E81119E1F3EF316DF473D69E9BFA77ACB2129D484112494A12EC0ED12B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

defense_evasion execution
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deobfuscate/Decode Files or Information
  Payload decoded via CertUtil.
  defense_evasion
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Badlisted process makes network request

Checks computer location settings

Deobfuscate/Decode Files or Information

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Deobfuscate/Decode Files or Information

Badlisted process makes network request

Checks computer location settings

Deobfuscate/Decode Files or Information

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Deobfuscate/Decode Files or Information

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Checks computer location settings

Deobfuscate/Decode Files or Information

Badlisted process makes network request

Checks computer location settings

Deobfuscate/Decode Files or Information

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12