Overview

overview

8

Static

static

1

Untitled design.png

windows10-2004-x64

8

Untitled design.png

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Untitled design.png
  • Size 1.6MB
  • Sample260713-b78psaa12m
  • SHA256 0c62b552ca073da574d90f1afbbead116ec65eac185203137fb737ac96bf60af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistence

Malware Config

Targets

    • Target
      Untitled design.png
    • Size 1.6MB
    • SHA256 0c62b552ca073da574d90f1afbbead116ec65eac185203137fb737ac96bf60af
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasiondiscoveryexecutionpersistence

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Prevents Microsoft Defender from scanning certain paths by adding an exclusion.

      Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

      defense_evasion

    • Hide Artifacts: Hidden Window

      Windows that would typically be displayed when an application carries out an operation can be hidden.

      defense_evasion

    • Hide Artifacts: Hidden Files and Directories

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks