fc50d8aaa943088d7677c9ec9fe7aa481e1762e75894dfa54ea1f11caf80d435 | Triage

Sharing

General

Target

21112024_0630_globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs.7z
Size

10KB
Sample

241121-g9knmatpbk
MD5

1652b45859598934f91f2d6945b8e50c
SHA1

4b910fb23d0887f69ab4427d57ed7c42bad893a3
SHA256

fc50d8aaa943088d7677c9ec9fe7aa481e1762e75894dfa54ea1f11caf80d435
SHA512

53d17d29177fe9a9f51436c66320bd0ceca755c0703a770ac1fb2690d3bf9ec128531777a6aa7f302d1ca8dfd922d7fbe92fc758a85376feea941ed01d4b3d4b
SSDEEP

192:0J7btvx05jMOuYbJ/T0akTyT0FpKKyFtj0e3Zj2b9D8RI8E3fFAw43:475vxKRnbJbuOoHyL0e392blMIF9zy

Score

8^/10

execution

Malware Config

Targets

- Target
  
  globe_product_order_korea_buy_20_11_2024_000000000000000000.vbs
- Size
  
  34KB
- MD5
  
  cb6936ce8eb2ba2d521916070ab46b7c
- SHA1
  
  8aa7fe3dca2da0bbbfe85e4373668120b111576e
- SHA256
  
  fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105
- SHA512
  
  60be01c49abe96142b94a48d244f771f42198ed845e81b6f79bafd0252942923637d00fa9fde50d08023fd1e4c717d3f7c527f32fdd88c835924a1e773db3d5a
- SSDEEP
  
  384:f9xJH9ENwdC0tLm5AJpOwVfHzSHh2/Ry0JZEjDkGxWxS7wUl8TlR:f9xd9ENwdfNZpOWfuh2533EnDH7oTH
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2