fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105 | Triage

Sharing

General

Target

fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105.vbs
Size

34KB
Sample

241121-kzf48svngp
MD5

cb6936ce8eb2ba2d521916070ab46b7c
SHA1

8aa7fe3dca2da0bbbfe85e4373668120b111576e
SHA256

fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105
SHA512

60be01c49abe96142b94a48d244f771f42198ed845e81b6f79bafd0252942923637d00fa9fde50d08023fd1e4c717d3f7c527f32fdd88c835924a1e773db3d5a
SSDEEP

384:f9xJH9ENwdC0tLm5AJpOwVfHzSHh2/Ry0JZEjDkGxWxS7wUl8TlR:f9xd9ENwdfNZpOWfuh2533EnDH7oTH

Score

8^/10

execution

Malware Config

Targets

- Target
  
  fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105.vbs
- Size
  
  34KB
- MD5
  
  cb6936ce8eb2ba2d521916070ab46b7c
- SHA1
  
  8aa7fe3dca2da0bbbfe85e4373668120b111576e
- SHA256
  
  fd3bf69fade10848b46e3d7c17d3fbcfdf66e0a500debaaad3d8a0dd4249d105
- SHA512
  
  60be01c49abe96142b94a48d244f771f42198ed845e81b6f79bafd0252942923637d00fa9fde50d08023fd1e4c717d3f7c527f32fdd88c835924a1e773db3d5a
- SSDEEP
  
  384:f9xJH9ENwdC0tLm5AJpOwVfHzSHh2/Ry0JZEjDkGxWxS7wUl8TlR:f9xd9ENwdfNZpOWfuh2533EnDH7oTH
Score

8^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2