Overview

overview

10

Static

static

1

1.wsf

windows7-x64

10

1.wsf

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1.wsf

  • Size

    219KB

  • Sample

    230605-3mz1pabb85

  • MD5

    bd10a43e91b28ff68e8c4a22858f1350

  • SHA1

    c9cbb1ca44136562d825a437f965dffe81b6da6e

  • SHA256

    4ae1cbc7da734a0f5d450c16979c950554aaa0d9635efc8fc3993a247c452007

  • SHA512

    ef5c96134f4fcb40a59fc59a5cf69826a4c468047473bc3dede866c16e7af4961dcb9e9c370ab7a166912f5a55c0d8a0bd3e69968c987a2c66121084a25a9820

  • SSDEEP

    3072:4IwVuSml31FFqsGtMOdlxiU44HdaGbepU05mAB1M8ZsK5UqEVPRZEEWKRb4QxSxE:ucl3/FyLdE4Hd+uamtRqE5WK5zwq

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://84.38.133.168/basaltom.java

Targets

    • Target

      1.wsf

    • Size

      219KB

    • MD5

      bd10a43e91b28ff68e8c4a22858f1350

    • SHA1

      c9cbb1ca44136562d825a437f965dffe81b6da6e

    • SHA256

      4ae1cbc7da734a0f5d450c16979c950554aaa0d9635efc8fc3993a247c452007

    • SHA512

      ef5c96134f4fcb40a59fc59a5cf69826a4c468047473bc3dede866c16e7af4961dcb9e9c370ab7a166912f5a55c0d8a0bd3e69968c987a2c66121084a25a9820

    • SSDEEP

      3072:4IwVuSml31FFqsGtMOdlxiU44HdaGbepU05mAB1M8ZsK5UqEVPRZEEWKRb4QxSxE:ucl3/FyLdE4Hd+uamtRqE5WK5zwq

    Score
    10/10

    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks