Overview

overview

8

Static

static

1

JPG_012.jpg.lnk

windows10-2004-x64

8

JPG_012.jpg.lnk

windows11-ltsc_2024-x64

8

JPG_013.jpg.lnk

windows10-2004-x64

8

JPG_013.jpg.lnk

windows11-ltsc_2024-x64

8

JPG_014.jpg.lnk

windows10-2004-x64

8

JPG_014.jpg.lnk

windows11-ltsc_2024-x64

8

spisokszch.xlsx.lnk

windows10-2004-x64

8

spisokszch.xlsx.lnk

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    fe285ab91a5adecebcab3e63343b56fba31e2a689ce12be582bc4f5ab04a768f.bin
  • Size 2.7MB
  • Sample260718-mtnm8sb15y
  • SHA256 fe285ab91a5adecebcab3e63343b56fba31e2a689ce12be582bc4f5ab04a768f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecution

Malware Config

Targets

    • Target
      JPG_012.jpg.lnk
    • Size 1.0MB
    • SHA256 5ddf0002140229322d1ff5c15d6bd716f7f32e4c17bdcfdeb53f1a3b7b04482c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral1behavioral2
    • Target
      JPG_013.jpg.lnk
    • Size 907KB
    • SHA256 7708f34aac754bf7fb76a4dcd732c4a81d90e05fb2cbcd2b480118835eb2f96b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral3behavioral4
    • Target
      JPG_014.jpg.lnk
    • Size 756KB
    • SHA256 a21df70bc9eb21d244f08dac11e3ee552277e33323c2fe54a233bfb17369518f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral5behavioral6
    • Target
      spisokszch.xlsx.lnk
    • Size 19KB
    • SHA256 b8f1dacdb17577282234dd5dc5751e8a7c8637834f4565464bb4cfaaee1e238d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks