a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc | Triage

Sharing

General

Target

PO_La-Tanerie04180240124.vbs
Size

187KB
Sample

240418-xprt7sdc4y
MD5

2ea61e83ee687b29c058279893e1df8c
SHA1

0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50
SHA256

a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc
SHA512

a810bd13d522775d4d9c3ef3e6775da5cc34db90d4826da9c96fb37c1d84dd37ad5eb84fc2c3095b3a9a065fbbd54a4892f96d867f879de14708d4f409f82ca8
SSDEEP

3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB

Score

8^/10

persistence

Malware Config

Targets

- Target
  
  PO_La-Tanerie04180240124.vbs
- Size
  
  187KB
- MD5
  
  2ea61e83ee687b29c058279893e1df8c
- SHA1
  
  0c6fc46e4a0bf4c62a5cd2e263313e82f2977a50
- SHA256
  
  a3483bf7a148434868b34bae2923006067f9e5e3ef2a2f62efaf6a32b93cddfc
- SHA512
  
  a810bd13d522775d4d9c3ef3e6775da5cc34db90d4826da9c96fb37c1d84dd37ad5eb84fc2c3095b3a9a065fbbd54a4892f96d867f879de14708d4f409f82ca8
- SSDEEP
  
  3072:2vU8jq6KK8ccABOwbDS2y2zJETxUuoHh38zH/O4SCvewvB7wrsCREBJo5mFSar+c:J6R8ccABOwbDA2zJETxVu1iH/GsW3EBB
Score

8^/10

persistence
- Adds policy Run key to start application
  persistence
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2