General
- Target Sin título.eml
- Size 10.1MB
- Sample260813-2m7vvszelh
- SHA256 71a21769f27869f20ad5fa4d312eb23dc96b9deeed4e3ef1b495477a0ce94f74
Score
8/10
Malware Config
Targets
-
- Target 5985.Original agrario-cuenta.xhtml
- Size 7.4MB
- SHA256 e25c9f9041db3dcb143ace1eba4c22dd58f503c957708698cd753472671041c7
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Deletes itself
-
Executes a VBScript file via the Windows Script Host.
-
Suspicious use of SetThreadContext
-
- Target email-html-2.txt
- Size 14KB
- SHA256 743a31c23a7113d0f7f9ee5dd8515c551c6d750fc668cc600cfa0b06e109da03
Score3/10 -
- Target email-plain-1.txt
- Size 1KB
- SHA256 dc380221d663399cfec29c32a48278d8ee561b29cd32ee4d5bb6a5569f88b951
Score1/10
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1