General
- Target photov_183117091485.zip
- Size 1KB
- Sample260729-nvgrragb53
- SHA256 eeeeccfefa06df87ef0bfee361639661e1dc5002e5ffea3836ba01976a67a9b3
Score
8/10
Malware Config
Targets
-
- Target photov_183117091485.lnk
- Size 2KB
- SHA256 66d8da0dd81bd28073abd9baeaa29fc0a04fb4d6887f2db77276c066bb06a8d9
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
- Target videoa_424869355153.mp4
- Size 1KB
- SHA256 451e8cfdc8c4a3775eece4bf39069de73a2f3b59c68ed2bc6a066bdf3d97fc6b
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1