Extracted

• • Target

    file.vbs

  • Size

    1KB

  • MD5

    427de2c0cee8968fce7def162aa80b81

  • SHA1

    32dbb23a5e02c64221a2bfe565917907b9c451fb

  • SHA256

    2de20f1efe94fbcbaced5d8a49a2b423d0c492b6d8463bd50c865cf77a467368

  • SHA512

    401ee0294796807e854c104865af20f0255bad9bc71bfc2a8fbe1a9f0dca26fd954ed24ad52860addc0e00f91e522633ff535c19945ab095e977fb56cbc13d49

  Score

  10^/10

  persistence

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Modifies Installed Components in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3behavioral4