3c1f84e8251c3bc39fb4e675fe1aa71d714d67bdbdedbabd127f0326379700fb

Sharing

Copy URL Twitter E-mail

General

Target
MSC_SHIPPING_DOCUMENTS(93930).zip
Size 35.6MB
Sample260722-fsr6psygmg
SHA256 3c1f84e8251c3bc39fb4e675fe1aa71d714d67bdbdedbabd127f0326379700fb
MD5 35728bd1d017faf77c8ec4aa1dfa35bc
SHA1 48a233f05006cb2de91d3c9d47328d41288f8cd4
SHA512 323231a2a4103e0b078e3d2df99858fbffecedf996bf0509c6c89a9872984e59ecd08f18e16c7f003fef969fce68fd18bd77d8e61c8b902a565335df158f3338
SSDEEP 786432:FPY1Az3ATtecG06QsFodGzrzzsEwN+4PphXiIgvWoE7:FPfUTEcG0vKzzsEgjhXi3vz2
TLSH
T1EE872217A2E60164D9BAC078CA6B9557EB723C06133067DF22A8B2556F73BF05A3F314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  BILL_OF_LADING__MSC_EXP_94921843.vbs
- Size 8KB
- SHA256 8e38a0a8d7facad2ae318cc08df7cf37380c096e1826e7ae12ced8363d2ccfbf
- MD5 abf48dbe09657523935c0e7ec6c435ad
- SHA1 91cb8d9e38aeb79fba2322ccd2c01f404974324e
- SHA512 9fd871b241d9bc8f366e4245fb369143a6f96c592e2bc19ce337415118fe7394d876d96ee8abe95bac092d9a8fd997f7c48883e4d8e5fff6176766d142f5526a
- SSDEEP 192:vzyjT2lDzeewPZNmRdqo0DdUzexzTQDz5s3wwkZrJ:+jTWDzeewaRR06etQDz5s3wwcrJ
- TLSH
  T15F020047FE112638C312D3B449B82C9CED95C1374CAA4958FAAC16182F26EE6B7D14F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  COMMERCIAL_INVOICE_MSC_EX_45429124.vbs
- Size 8KB
- SHA256 8e38a0a8d7facad2ae318cc08df7cf37380c096e1826e7ae12ced8363d2ccfbf
- MD5 abf48dbe09657523935c0e7ec6c435ad
- SHA1 91cb8d9e38aeb79fba2322ccd2c01f404974324e
- SHA512 9fd871b241d9bc8f366e4245fb369143a6f96c592e2bc19ce337415118fe7394d876d96ee8abe95bac092d9a8fd997f7c48883e4d8e5fff6176766d142f5526a
- SSDEEP 192:vzyjT2lDzeewPZNmRdqo0DdUzexzTQDz5s3wwkZrJ:+jTWDzeewaRR06etQDz5s3wwcrJ
- TLSH
  T15F020047FE112638C312D3B449B82C9CED95C1374CAA4958FAAC16182F26EE6B7D14F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4
- Target
  CUSTOM_REFERENCE_CERTIFICATES_91618105.vbs
- Size 8KB
- SHA256 8e38a0a8d7facad2ae318cc08df7cf37380c096e1826e7ae12ced8363d2ccfbf
- MD5 abf48dbe09657523935c0e7ec6c435ad
- SHA1 91cb8d9e38aeb79fba2322ccd2c01f404974324e
- SHA512 9fd871b241d9bc8f366e4245fb369143a6f96c592e2bc19ce337415118fe7394d876d96ee8abe95bac092d9a8fd997f7c48883e4d8e5fff6176766d142f5526a
- SSDEEP 192:vzyjT2lDzeewPZNmRdqo0DdUzexzTQDz5s3wwkZrJ:+jTWDzeewaRR06etQDz5s3wwcrJ
- TLSH
  T15F020047FE112638C312D3B449B82C9CED95C1374CAA4958FAAC16182F26EE6B7D14F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral5 behavioral6
- Target
  PACKING_LIST_MSC_EX_38784515.vbs
- Size 8KB
- SHA256 8e38a0a8d7facad2ae318cc08df7cf37380c096e1826e7ae12ced8363d2ccfbf
- MD5 abf48dbe09657523935c0e7ec6c435ad
- SHA1 91cb8d9e38aeb79fba2322ccd2c01f404974324e
- SHA512 9fd871b241d9bc8f366e4245fb369143a6f96c592e2bc19ce337415118fe7394d876d96ee8abe95bac092d9a8fd997f7c48883e4d8e5fff6176766d142f5526a
- SSDEEP 192:vzyjT2lDzeewPZNmRdqo0DdUzexzTQDz5s3wwkZrJ:+jTWDzeewaRR06etQDz5s3wwcrJ
- TLSH
  T15F020047FE112638C312D3B449B82C9CED95C1374CAA4958FAAC16182F26EE6B7D14F9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral7 behavioral8
- Target
  VJOMGb/LogMeInResolve_Unattended.msi
- Size 35.6MB
- SHA256 29906168eba271442305389aebe91a5091ae933d551101ad60087f699ca2630f
- MD5 ab7e7ff9fc24a0b1f8ad7863c4a0a2ec
- SHA1 96f043a70e69af7759e92b60dadf507e906bc2c0
- SHA512 10ba657c9baf30cc7e5a2f2339c5398687b1de74e98a823ea5fe3f2eb857683a15b9f9b61f727aa9e2760bccb16f826183e4a26820b4e96e7f2d5f3033ddf99e
- SSDEEP 786432:yPY1Az3ATtecG06QsFodGzrzzsEwN+4PphXiIgvWoE:yPfUTEcG0vKzzsEgjhXi3vz
- TLSH
  T133872217A2E601A4D9BAC078CA6B9657EB723C06133067DF12A4B2556F73BF05A3F314
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

persistence privilege_escalation
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  VJOMGb/install.vbs
- Size 7KB
- SHA256 7944ed8753971f952130ea0c52a0ee9d7cef42f33b176234b08ab7f97a2cd262
- MD5 ec81ebe8626be673f2000e8ca4cfc55c
- SHA1 400fd553f62af6b8dcb980530f3ffbfa03617f13
- SHA512 5724df73ca0f80d36f7eef887788e4803950fac941e6005859bdb45e16b358b1f4b980e12fb90acc3c01cbf1bd8d31ec4ec6f7756259bb8acf8bdb62c1bbc207
- SSDEEP 192:cqP5A2w/8J5HNBT2kvE+lKyFVrNPT+82OuTa4SfqPwY:c0A1UB52kvEYKyFVrNPT+1OmIY
- TLSH
  T1E0E1A517BEA3833096E385A891AE0C1D86E69723506F44D5FBEC49941F18BFD93B0CD8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

backdoor defense_evasion execution persistence rat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- GoToResolve remote administration tool
  GoToResolve is a remote administration tool that can be used as a backdoor
  backdoor rat
- Loads dropped DLL
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks system information in the registry
  System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral11 behavioral12

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Executes a VBScript file via the Windows Script Host.

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

GoToResolve remote administration tool

Loads dropped DLL

Badlisted process makes network request

Enumerates connected drives

Checks system information in the registry

Drops file in System32 directory

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12