cdea919cf913a1cb8aa9ef0dc263ddffaabafab4139b154af0cfa801c00fbfe8 | Triage

Sharing

General

Target

trigger.vbs
Size

75B
Sample

240524-v6qmcsdh69
MD5

520a3ec50de35a52fe49b645b4af9a9e
SHA1

dc244939b8eedae3791b025a1780b9464ede5713
SHA256

cdea919cf913a1cb8aa9ef0dc263ddffaabafab4139b154af0cfa801c00fbfe8
SHA512

f15bd0410081fd396fb6ac2062f9507f155ebb4babcb604ab5acfd38e32dfeabb57fae4a3718b3c614b8f0dcc3bbb62af7fd1375e121050d36ce515ee400db60

Score

10^/10

evasion persistence

Malware Config

Targets

- Target
  
  trigger.vbs
- Size
  
  75B
- MD5
  
  520a3ec50de35a52fe49b645b4af9a9e
- SHA1
  
  dc244939b8eedae3791b025a1780b9464ede5713
- SHA256
  
  cdea919cf913a1cb8aa9ef0dc263ddffaabafab4139b154af0cfa801c00fbfe8
- SHA512
  
  f15bd0410081fd396fb6ac2062f9507f155ebb4babcb604ab5acfd38e32dfeabb57fae4a3718b3c614b8f0dcc3bbb62af7fd1375e121050d36ce515ee400db60
Score

10^/10

evasion persistence
- Modifies firewall policy service
  evasion
- Modifies security service
  evasion
- Registers new Print Monitor
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence