743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1 | Triage

Sharing

General

Target

743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1.vbs
Size

167KB
Sample

240326-c2wcyabh93
MD5

167f6046d186ff6fcb3f6620063a0de2
SHA1

f2b98e37d076177d793b7933aaad6b1184ee58d5
SHA256

743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1
SHA512

4f399e5d28f4b12ae17f06c4a6eae742732f2047d5cd06a37aa06bb6eecc4a57215d5faac320a186fd48050516ee89c585aef9239ab57493fc70ef89bed23a3c
SSDEEP

3072:sT4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR2DOFN0m4VGEvyM+gZM6MEMy2Im:sT4yENVOY0NpVXpK68kH3DPbkhZi3eNb

Score

8^/10

Malware Config

Targets

- Target
  
  743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1.vbs
- Size
  
  167KB
- MD5
  
  167f6046d186ff6fcb3f6620063a0de2
- SHA1
  
  f2b98e37d076177d793b7933aaad6b1184ee58d5
- SHA256
  
  743a36af1075b2ed3a96048db1db5584273ec49029add4fdd00070650aca67a1
- SHA512
  
  4f399e5d28f4b12ae17f06c4a6eae742732f2047d5cd06a37aa06bb6eecc4a57215d5faac320a186fd48050516ee89c585aef9239ab57493fc70ef89bed23a3c
- SSDEEP
  
  3072:sT4yENVBkYr4LhpVXpKnupn8kH3DPbkhZi3eNR2DOFN0m4VGEvyM+gZM6MEMy2Im:sT4yENVOY0NpVXpK68kH3DPbkhZi3eNb
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2