General
- Target photov_776274188255.zip
- Size 1KB
- Sample260729-ntwjhsshpe
- SHA256 f4b3816a777574f642113def076a0dd356e668af8e3354185759f682172a2fd4
Score
8/10
Malware Config
Targets
-
- Target photov_776274188255.lnk
- Size 2KB
- SHA256 17d69a1b7cb10939c79cf3dffbb293089de524e1f14e2c32ed79d5e613c1941b
Score8/10Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Suspicious use of SetThreadContext
-
- Target videoa_489140411241.mp4
- Size 1KB
- SHA256 98977490bcdfdff5ad5f610f4d4ec84c0fee830c53315e3326c9d45d2213cf01
Score7/10Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1