General
- Target ssa_document.vbs
- Size 5.1MB
- Sample260709-lql5kaf16p
- SHA256 b60bf8c65bfee063e53cb392d5c8c62e63a5bd08cc4ea9494d35cafec918e372
Score
10/10
Malware Config
Targets
-
- Target ssa_document.vbs
- Size 5.1MB
- SHA256 b60bf8c65bfee063e53cb392d5c8c62e63a5bd08cc4ea9494d35cafec918e372
Score10/10Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Registers new Windows logon scripts automatically executed at logon.
Adds Run key to start application
Deobfuscate/Decode Files or Information
Payload decoded via CertUtil.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Defense Evasion
Deobfuscate/Decode Files or Information
1Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
2