General
- Target photov_001127393551.zip
- Size 1KB
- Sample260729-ntwvaashqb
- SHA256 49a8507e58f1ffbfc025d406a6fc9fa3ccc9f70e14ba46d40e5240529eca9e2d
Score
8/10
Malware Config
Targets
-
- Target photov_001127393551.lnk
- Size 2KB
- SHA256 345c6d6bd832e7387b1ed1c30f2ccd88dcfe30afc49403b32f398a2a9bb785f7
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_200015949577.mp4
- Size 1KB
- SHA256 0f94b4737fe4bc39eb986bd5a5931b35e37687696735300af78b173beef64308
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1