df610fe1800c5c643599d46f147e0e0623b5523e54e3b0795f2e4e2be88ba952 | Triage

Sharing

General

Target

df610fe1800c5c643599d46f147e0e0623b5523e54e3b0795f2e4e2be88ba952.vbs
Size

489KB
Sample

241005-ca8h7ayekp
MD5

b4ed8d97bb9132e15502eb005580d3e1
SHA1

eb64b5bfbb04979d46b7f906394caadbe96e5c4f
SHA256

df610fe1800c5c643599d46f147e0e0623b5523e54e3b0795f2e4e2be88ba952
SHA512

d6446d9a7120f2460216c24ee92045d3a435d8987f38375bbae41a66022a03147b40b42174a838be0b73019147fe83e30708267cbc83f44199895a486f746e85
SSDEEP

12288:+IM9DK7pKt0qbfzQ0mfRygWqa8kPDXwlvX+LHqDDuu++MZu+Df2OW6:+ImrsHflxw5

Score

8^/10

discovery execution

Malware Config

Targets

- Target
  
  df610fe1800c5c643599d46f147e0e0623b5523e54e3b0795f2e4e2be88ba952.vbs
- Size
  
  489KB
- MD5
  
  b4ed8d97bb9132e15502eb005580d3e1
- SHA1
  
  eb64b5bfbb04979d46b7f906394caadbe96e5c4f
- SHA256
  
  df610fe1800c5c643599d46f147e0e0623b5523e54e3b0795f2e4e2be88ba952
- SHA512
  
  d6446d9a7120f2460216c24ee92045d3a435d8987f38375bbae41a66022a03147b40b42174a838be0b73019147fe83e30708267cbc83f44199895a486f746e85
- SSDEEP
  
  12288:+IM9DK7pKt0qbfzQ0mfRygWqa8kPDXwlvX+LHqDDuu++MZu+Df2OW6:+ImrsHflxw5
Score

8^/10

discovery execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Remote System Discovery

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryexecution

behavioral2

discoveryexecution