General
- Target 04052026_1505_World Energy PO# ZY-2604-27-pdf.vbs.zip
- Size 41KB
- Sample260504-sga49set71
- SHA256 e78a9ad21d800c6a3bad91298e797cf4276b8ac0d54240df0d2b65926ece6495
Score
10/10
Malware Config
Targets
-
- Target World Energy PO# ZY-2604-27-pdf.vbs
- Size 2.9MB
- SHA256 6d93b1edb1cc9d34899ce6e357653506f0b79bdaa3697e13d013359936079f18
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext