General
- Target photov_953091616750.zip
- Size 1KB
- Sample260729-ntv8rashpb
- SHA256 d7c3b3e9ee4cfc3cac71ee8cd92309e4115360af5f7e155aa0d67e13a367713a
Score
8/10
Malware Config
Targets
-
- Target photov_953091616750.lnk
- Size 2KB
- SHA256 9cfc15067b8730fc8f73d9b0c6c467e9c7d207879aaa8bcf1adf791c7a5b75a3
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_039810395331.mp4
- Size 1KB
- SHA256 20c12e6e388b4977c1e586bbce2e800b1fe482d14c41cc0b26e65366326d82ee
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1