Static

static

MANQUEDB_8...66.vbs

windows7_x64

9

MANQUEDB_8...66.vbs

windows10_x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    MANQUEDB_829028353025266.vbs

  • Size

    36.2MB

  • Sample

    200619-6w5t5l3tzs

  • MD5

    35f91ef6a9f5cbba47555ed092cda0fc

  • SHA1

    b2df8023f4821752020a73a6095e4790abd9d86f

  • SHA256

    a9b3e1a86a6317650881c9c631410482521c130de594bcbf91ef1f5f24d038a9

  • SHA512

    6039715f0b0a92dd6babf65c4fe50c1cb82531f9d60154ca3fe8cd371c31bffca0fbbc064b23de712fca9556e0e5e7ba917fd519cc27607e2d692820c7b9e940

Score
9/10
cryptonepacker

Malware Config

Targets

    • Target

      MANQUEDB_829028353025266.vbs

    • Size

      36.2MB

    • MD5

      35f91ef6a9f5cbba47555ed092cda0fc

    • SHA1

      b2df8023f4821752020a73a6095e4790abd9d86f

    • SHA256

      a9b3e1a86a6317650881c9c631410482521c130de594bcbf91ef1f5f24d038a9

    • SHA512

      6039715f0b0a92dd6babf65c4fe50c1cb82531f9d60154ca3fe8cd371c31bffca0fbbc064b23de712fca9556e0e5e7ba917fd519cc27607e2d692820c7b9e940

    Score
    9/10
    cryptonepacker

    • CryptOne packer

      Detects CryptOne packer defined in NCC blogpost.

      cryptonepacker

    • Blacklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks