General

  • Target

    doc2406.vbs

  • Size

    12.1MB

  • Sample

    240624-tb7rqazgna

  • MD5

    e856c9c8a1e97ce7f7967e6c8639eb8e

  • SHA1

    e5c6fc9f889e45916676ac6502475d5f8300ca3f

  • SHA256

    321a9b3b7928f4077d15f0ef554489eb084edd01118d455a72b9954455d7be4b

  • SHA512

    fb643c70c63b671c24fa60e3bdcba063e4a4c5b86010a58e82dabe4f0519bbcd3490443779319c46b9d730a71ff40824e7d04d74846f737c2b28bee6ef621cc7

  • SSDEEP

    49152:7VlLVlHVlKVldVltVltVlYVlBVlSVl2VlnVlfVleVlCVl/VlzVlMVlsVl/VlTVl3:P

Score
10/10

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

https://rentry.co/m7ebw9yf/raw

Targets

    • Target

      doc2406.vbs

    • Size

      12.1MB

    • MD5

      e856c9c8a1e97ce7f7967e6c8639eb8e

    • SHA1

      e5c6fc9f889e45916676ac6502475d5f8300ca3f

    • SHA256

      321a9b3b7928f4077d15f0ef554489eb084edd01118d455a72b9954455d7be4b

    • SHA512

      fb643c70c63b671c24fa60e3bdcba063e4a4c5b86010a58e82dabe4f0519bbcd3490443779319c46b9d730a71ff40824e7d04d74846f737c2b28bee6ef621cc7

    • SSDEEP

      49152:7VlLVlHVlKVldVltVltVlYVlBVlSVl2VlnVlfVleVlCVl/VlzVlMVlsVl/VlTVl3:P

    Score
    10/10
    • Blocklisted process makes network request

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks