19a3ad194ce6897b529e09a60beb959520e5fc70930d95393d304a42a70a7119 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

lnvoice #72993 pdf.vbs
Size

8KB
Sample

230816-q1vlxada5s
MD5

267ec14523d9fda264f9fbee934eebe0
SHA1

e19bfb59009da3d192f024222070e01a9a1bb258
SHA256

19a3ad194ce6897b529e09a60beb959520e5fc70930d95393d304a42a70a7119
SHA512

a2d95be94aa3629e4be2341135213caf486426e36ca34fd1a89e38767ed0257f08e90bd2b694e6b3134495cde9cf746845c54141a7e4ecec2d468c34b6622652
SSDEEP

24:vOOOOOOamMMM9Mk4wMUMbwMRMUMqMMMBeMZMTMoMVnnLecYMSQxH:6mKywV8V9nDW

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  lnvoice #72993 pdf.vbs
- Size
  
  8KB
- MD5
  
  267ec14523d9fda264f9fbee934eebe0
- SHA1
  
  e19bfb59009da3d192f024222070e01a9a1bb258
- SHA256
  
  19a3ad194ce6897b529e09a60beb959520e5fc70930d95393d304a42a70a7119
- SHA512
  
  a2d95be94aa3629e4be2341135213caf486426e36ca34fd1a89e38767ed0257f08e90bd2b694e6b3134495cde9cf746845c54141a7e4ecec2d468c34b6622652
- SSDEEP
  
  24:vOOOOOOamMMM9Mk4wMUMbwMRMUMqMMMBeMZMTMoMVnnLecYMSQxH:6mKywV8V9nDW
Score

8^/10

persistence
- Blocklisted process makes network request
- Drops startup file
- Registers COM server for autorun
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2