Extracted

Extracted

• • Target

    7e716d3e3294621ecbfca2fb2344659adab0186027eb9cf4511617db9bf8896d.vbs

  • Size

    681KB

  • MD5

    746d8713599ad10435ccced5549288b5

  • SHA1

    457928dea2de0daa5742f05d51ab8b18aefb893a

  • SHA256

    7e716d3e3294621ecbfca2fb2344659adab0186027eb9cf4511617db9bf8896d

  • SHA512

    dc1f3da919b6b8e9044f489ccb0fdf95f18ddd70cbf7dd12a4a01adac0876d5b2a2ddbbdafa6384ead6f769b9e71827bf9dc67fcd8fae146e28234b89fff42b4

  • SSDEEP

    1536:9SSSSSSSSSSSSSSSSSSSSSSSx22222222222222222222222222222222222222v:UChJDK

  Score

  10^/10

  execution

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution
  behavioral1behavioral2