8fbe734f092fe38ef0ad6fdffe8437560a8f5251a0839c019babd195d54eb10c | Triage

Sharing

General

Target

Patrick_Amanda_tax_Files.vbs
Size

22KB
Sample

240806-lyy44awekl
MD5

9695fffacf82b213c5de3540c88d5a58
SHA1

0e6e8efb0a5b97ef35497d65957142cff1b3f098
SHA256

8fbe734f092fe38ef0ad6fdffe8437560a8f5251a0839c019babd195d54eb10c
SHA512

0ef6040615c089d0dc12a4e6acb1cf1b04e176dccfae1d9aa1347cd57502632cdec75464166ef861532ecca2584eff35e32530f8e8f1c9a42d1d250d3a761073
SSDEEP

384:vv0IEaMWsOEreJZl3MTxSiMFpWrd2Wxol4cgbD:vvhsOE0Zl3uSwzyl4Pv

Score

8^/10

execution

Malware Config

Targets

- Target
  
  Patrick_Amanda_tax_Files.vbs
- Size
  
  22KB
- MD5
  
  9695fffacf82b213c5de3540c88d5a58
- SHA1
  
  0e6e8efb0a5b97ef35497d65957142cff1b3f098
- SHA256
  
  8fbe734f092fe38ef0ad6fdffe8437560a8f5251a0839c019babd195d54eb10c
- SHA512
  
  0ef6040615c089d0dc12a4e6acb1cf1b04e176dccfae1d9aa1347cd57502632cdec75464166ef861532ecca2584eff35e32530f8e8f1c9a42d1d250d3a761073
- SSDEEP
  
  384:vv0IEaMWsOEreJZl3MTxSiMFpWrd2Wxol4cgbD:vvhsOE0Zl3uSwzyl4Pv
Score

8^/10

execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2