0e8b0b60f15a760e73f912ca962fe62d49dab8314aca1d1e3d2d9a62cf8f2602 | Triage

Sharing

General

Target

Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.7z
Size

52KB
Sample

240709-ncl9hs1ern
MD5

c2d99609e4974673a23fd0567a306f44
SHA1

e1f27c11b726e73c7ce9d17f75e9dcf796f206e3
SHA256

0e8b0b60f15a760e73f912ca962fe62d49dab8314aca1d1e3d2d9a62cf8f2602
SHA512

08dec4c1d9b69ddf5c75d29a29ce3e0a0119e1cf7caba08c84eda99a102de70ea8a94297dcb2fe2e371c2cd9569811a3b283d4231637c36467994b0771b5e5af
SSDEEP

1536:oLh+VFNvG8ZXgAvPkBMPb5JbxBY6ehmEG7cu6YZ:CSN+cXfPkOj5bBY7whx6g

Score

8^/10

Malware Config

Targets

- Target
  
  Awb_Shipping_doc_pdf_00900720242247820020091808174CN18009007000000924.vbs
- Size
  
  102KB
- MD5
  
  7830b84566e2614c62d98026bff38786
- SHA1
  
  bf275fe87ba08ef95283293728ddcedd8a5a38b2
- SHA256
  
  e1bcd4fae5185f9d9e377759ed4500755c065a9db7f55f0589ba10b1ea9d330b
- SHA512
  
  dd95218ce35833e06bfe51136642975761c649d16f53bd1d55f3371866b61b57e41d3a4986379581f7b6ce4ff36db2e66139d1845e48a6f323d8def13d031bbb
- SSDEEP
  
  3072:+4oGKaBSPReHzR0WAjT28fyxa+CS64B9Ou4rIQCtvF:/t7SPReHd0WoT28faa+CS64mu8IQCtvF
Score

8^/10
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2