General
- Target photov_336948176123.zip
- Size 1KB
- Sample260729-ntw52sshqd
- SHA256 20095f8b7368bb158850894fe6af6af04cb725ffe3a233a5ffba3c6c34732737
Score
8/10
Malware Config
Targets
-
- Target photov_336948176123.lnk
- Size 2KB
- SHA256 a788f4eac8fa3b79ebcb84142c03221fde097cd4a2325076a5cd09d282783757
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_297701399557.mp4
- Size 1KB
- SHA256 2ff292b0a2f466657712603f1a19c66646dbfbc19a4d4ad4d5d6cd46af2a1dcb
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1