General

  • Target

    https://verification-module-v2.b-cdn.net/recaptcha_verification_updated.html

  • Sample

    241115-thx6vswmdw

Score
10/10

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://bot-filter-tx.b-cdn.net/build-variation-1.txt

Targets

    • Target

      https://verification-module-v2.b-cdn.net/recaptcha_verification_updated.html

    Score
    10/10
    • Blocklisted process makes network request

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

    • Executes dropped EXE

    • Uses the VBS compiler for execution

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks