e865a8cc36db489adacecd0932e4b07d9320402532c5e15918c377bbda156c37 | Triage

Sharing

General

Target

e865a8cc36db489adacecd0932e4b07d9320402532c5e15918c377bbda156c37.vbs
Size

79KB
Sample

241119-ngqgqsvera
MD5

af1d73edd871bf6f26fa1561a95a0175
SHA1

235b37402a70e5c7626f6a73d33a7483c628c0ee
SHA256

e865a8cc36db489adacecd0932e4b07d9320402532c5e15918c377bbda156c37
SHA512

8c9bb59ceb94b7c10e4cd7741e5a0ce1d6206b0999a3cdd5befc364e25e38eb3497d930ab64e1f0c8b9b8103bfca195a9489cc331e165c10efddba1d17702c81
SSDEEP

768:vilsosMils8ZiBiMils4iBi5ilsMilsJiBiMilsJiBiwils2CBz/W3WFsMilsJiX:jCBz/09

Score

8^/10

execution

Malware Config

Targets

- Target
  
  e865a8cc36db489adacecd0932e4b07d9320402532c5e15918c377bbda156c37.vbs
- Size
  
  79KB
- MD5
  
  af1d73edd871bf6f26fa1561a95a0175
- SHA1
  
  235b37402a70e5c7626f6a73d33a7483c628c0ee
- SHA256
  
  e865a8cc36db489adacecd0932e4b07d9320402532c5e15918c377bbda156c37
- SHA512
  
  8c9bb59ceb94b7c10e4cd7741e5a0ce1d6206b0999a3cdd5befc364e25e38eb3497d930ab64e1f0c8b9b8103bfca195a9489cc331e165c10efddba1d17702c81
- SSDEEP
  
  768:vilsosMils8ZiBiMils4iBi5ilsMilsJiBiMilsJiBiwils2CBz/W3WFsMilsJiX:jCBz/09
Score

8^/10

execution
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2