General
- Target 21042026_1613_ChatGPT-Security-5.2.3.vbs.zip
- Size 1.2MB
- Sample260421-tpem4ahs7l
- SHA256 cf132bbefa748dbd15827d5b75b826376cc0e93cc4dc31d6183e53e32aaa079b
Malware Config
Targets
-
- Target ChatGPT-Security-5.2.3.vbs
- Size 3.9MB
- SHA256 3c1764ef9e474a1657abfe712244107b15d4b90a53a63000f9f4f98cc38821a7
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks whether UAC is enabled
-
Command and Scripting Interpreter: PowerShell
Using powershell.exe command.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Password Policy Discovery
Attempt to access detailed information about the password policy used within an enterprise network.
-
Remote Services: SMB/Windows Admin Shares
Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1