Extracted

Extracted

• • Target

    c148847fa77cb45993ded6736c2412bae37c4abb497ac401ffe48ef59172304e.vbs

  • Size

    691KB

  • MD5

    56258f68ad095965e7ef46b623d68619

  • SHA1

    780a03a86b36e69f5169905fa52bc352b1c993a2

  • SHA256

    c148847fa77cb45993ded6736c2412bae37c4abb497ac401ffe48ef59172304e

  • SHA512

    4461f4de2fb0dc61e0e0dc62347eca655e4980ad3f222453a3dbfb6533b13b6bee9ee9cbf122db508639968fdb671b42154d1460ac6e967d47b3fd5518f96a3f

  • SSDEEP

    1536:VPPPPPPPPPPPPPPPPPPPPPPPE77777777777777777777777777777777777777v:45VLpOe/

  Score

  10^/10

  executiondefense_evasionpersistence

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2