General
- Target https://drive.google.com:download_EtTRMaWnH3t38_file_dcMhPOIsx6CRIIHzhO4zZwgQ1Q0n4hPkhvxnjCaRTMdVQPWpTHj5C0IKit0YXq44v@dropbox.com/scl/fi/whvyzhbjo64oh5uususel/nouveau_curriculum_vitae.vbs?JoTt77TOeP2oLr2kGTyZdttUiA1uOns3AQvI7CdlEc7GRmrjn0EWSpLiLSXU3TDgc=3ml2TGp20yS3hpK2gEachEZVfvBTQQ86m1uU39ZQSFvHPnEi93ZkIGe1nwoaIzVaSELp6TlLRvnQe&rlkey=y8b7mx7v0ckwfagj8dyyzmpv8&dl=1&EpfplniyOdce5pwCpXTzobsF27Z4MwVSHArwoY3VamlUUC=3RsZRkegcxWaguROgryH71BaxzywUnsiCG0ZMuE7LYBjN9yU782LKUsg2se/#PXPUzuc6FhcARrkS7fjwQDB6eOR5GP5WL2MmgD8XDF4uPrfn09VA3U5ODgLTGai9
- Sample260629-jjee2agt4y
Score
8/10
Malware Config
Targets
-
- Target https://drive.google.com:download_EtTRMaWnH3t38_file_dcMhPOIsx6CRIIHzhO4zZwgQ1Q0n4hPkhvxnjCaRTMdVQPWpTHj5C0IKit0YXq44v@dropbox.com/scl/fi/whvyzhbjo64oh5uususel/nouveau_curriculum_vitae.vbs?JoTt77TOeP2oLr2kGTyZdttUiA1uOns3AQvI7CdlEc7GRmrjn0EWSpLiLSXU3TDgc=3ml2TGp20yS3hpK2gEachEZVfvBTQQ86m1uU39ZQSFvHPnEi93ZkIGe1nwoaIzVaSELp6TlLRvnQe&rlkey=y8b7mx7v0ckwfagj8dyyzmpv8&dl=1&EpfplniyOdce5pwCpXTzobsF27Z4MwVSHArwoY3VamlUUC=3RsZRkegcxWaguROgryH71BaxzywUnsiCG0ZMuE7LYBjN9yU782LKUsg2se/#PXPUzuc6FhcARrkS7fjwQDB6eOR5GP5WL2MmgD8XDF4uPrfn09VA3U5ODgLTGai9
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.