4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066 | Triage

Sharing

General

Target

4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066.vbs
Size

2.3MB
Sample

240517-brx84sag5z
MD5

634eb9320cb4f68904ae3b1a7f79e618
SHA1

774cd24cdd4f048a2a8c8e922e7a4d38fd3189b0
SHA256

4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066
SHA512

3dc169aa442a40bfffca11f83e50424eddb19f3a81a0a7546567025ce7d8e9c7f53fedd39a5a4b9db83c07ff8067b6a540a294a1cd22f0457c06ed0fc55afd48
SSDEEP

1536:yDirsVK3UWzV4AgpQqfmaB27EXtBSgb8N2nCDlez32htAYYjqNRv5Lv6cHRbIRdx:TSN3ek

Score

8^/10

execution

Malware Config

Targets

- Target
  
  4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066.vbs
- Size
  
  2.3MB
- MD5
  
  634eb9320cb4f68904ae3b1a7f79e618
- SHA1
  
  774cd24cdd4f048a2a8c8e922e7a4d38fd3189b0
- SHA256
  
  4b056176eff38ea62624a06c424eb2ff021a616c884295d4b79366c1dc2aa066
- SHA512
  
  3dc169aa442a40bfffca11f83e50424eddb19f3a81a0a7546567025ce7d8e9c7f53fedd39a5a4b9db83c07ff8067b6a540a294a1cd22f0457c06ed0fc55afd48
- SSDEEP
  
  1536:yDirsVK3UWzV4AgpQqfmaB27EXtBSgb8N2nCDlez32htAYYjqNRv5Lv6cHRbIRdx:TSN3ek
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2