Overview

overview

10

Static

static

1

script.vbs

windows7-x64

10

script.vbs

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    script.vbs
  • Size 659B
  • Sample240526-y2maxsbf45
  • SHA256 2bb9c07e14591f2c0640cc7e9ae0ca347d5b14ca2fed03de2f761a5a31b5e328
  • MD5 SHA1 SHA512
Score
10/10
adwarepersistencestealer

Malware Config

Targets

    • Target
      script.vbs
    • Size 659B
    • SHA256 2bb9c07e14591f2c0640cc7e9ae0ca347d5b14ca2fed03de2f761a5a31b5e328
    • MD5 SHA1 SHA512
    Score
    10/10
    adwarepersistencestealer

    • Adds autorun key to be loaded by Explorer.exe on startup

      persistence

    • Manipulates Digital Signatures

      Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

    • Modifies Installed Components in the registry

      persistence

    • Sets file execution options in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Modifies system executable filetype association

      persistence

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks