12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4

General

Target
487f50601f6106842001e7f7b6369a2a.vbs
Size 1.1MB
Sample260217-h6dxcaa19f
SHA256 12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4
MD5 487f50601f6106842001e7f7b6369a2a
SHA1 b540282d1abcddf883c4d4869eb7ded26f0c3773
SHA512 387def61f23958073108a7147ec525462a470989c921b9a6c074230b646c4267d0bd7b7546f116c11028dd1837c60633c55e892bbe91eea10456233572894f61
SSDEEP 192:faxFsKtFsKoFJdu6l23CPNm5ZHfkPKTF8LTomWnxX2oCPNEo7H7cEHtFPKoFCMnG:DC
TLSH
T1D64545FE3F8A2623B5B75F50500440D9E94FC4812D4927C8FDCAE660654F2EE1662EBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution persistence

Malware Config

Extracted

Language

ps1

Deobfuscated

Source

URLs

ps1.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png
exe.dropper
https://ia600603.us.archive.org/13/items/msi-pro-with-b-64_202602/MSI_PRO_with_b64.png

Targets

- Target
  487f50601f6106842001e7f7b6369a2a.vbs
- Size 1.1MB
- SHA256 12fdceb6d837be10e3cd18faeaed560e027a42cb9f0e5a9fb35cc64a236be8d4
- MD5 487f50601f6106842001e7f7b6369a2a
- SHA1 b540282d1abcddf883c4d4869eb7ded26f0c3773
- SHA512 387def61f23958073108a7147ec525462a470989c921b9a6c074230b646c4267d0bd7b7546f116c11028dd1837c60633c55e892bbe91eea10456233572894f61
- SSDEEP 192:faxFsKtFsKoFJdu6l23CPNm5ZHfkPKTF8LTomWnxX2oCPNEo7H7cEHtFPKoFCMnG:DC
- TLSH
  T1D64545FE3F8A2623B5B75F50500440D9E94FC4812D4927C8FDCAE660654F2EE1662EBE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

execution persistence
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell
  Powershell Invoke Web Request.
  execution
- Command and Scripting Interpreter: PowerShell
  Run Powershell and hide display window.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

PowerShell

2

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Process spawned unexpected child process

Badlisted process makes network request

Command and Scripting Interpreter: PowerShell

Command and Scripting Interpreter: PowerShell

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2