General
- Target photov_323085435055.zip
- Size 1KB
- Sample260729-ntxftashra
- SHA256 05960451cd9f8bf4923f125aff729b16050a0c0a251b6792292126a5037a64a1
Score
8/10
Malware Config
Targets
-
- Target photov_323085435055.lnk
- Size 2KB
- SHA256 25dfae93b1108728f214c19030acd2d0a45d9c66bfb9a740ebc724a8b22ae2d8
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_904112687634.mp4
- Size 1KB
- SHA256 691f562fbda53b9521419a674f0db246c5ac6906b24b84285e77efbf8de934b8
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1