General
- Target photov_312392808540.zip
- Size 1KB
- Sample260729-ntwvaavwbx
- SHA256 4298199643f6b5f7ca53e19cad60d3e210ccd0d809e3c2878b1ecb8afa1d2984
Score
8/10
Malware Config
Targets
-
- Target photov_312392808540.lnk
- Size 2KB
- SHA256 4cede7bc84ab29a4786ae35478773990b42a553c062bba8ae094bd40a8ed50ad
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_073184435028.mp4
- Size 1KB
- SHA256 1c3155c4c19b6b6c8584ff31af0aa97c7cb16d7918003ef5839c421ac1f88304
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1