679c490a6944950e60577a42c5ef3be9ca7d7774cba0ad550defded5cc523f60

General

Target
adb_fmkr17vgpmbb2_v37962.vbs
Size 104KB
Sample260722-pfb4dsvalg
SHA256 679c490a6944950e60577a42c5ef3be9ca7d7774cba0ad550defded5cc523f60
MD5 d62b1fc36ef4bc5057ef1285f58f31f6
SHA1 735681f1bd485752e174148882ff644d8df41c70
SHA512 7bde15a3c177a43c99e01ccb78933ab739ecbbac93864f2ba742bd47249e5a624c9b66a8123818a2048ece1de3adc86ff5107975abb163416689999ca13e0f92
SSDEEP 1536:7DczeRhKBnh6L2vs+W2ZYxfxwZ/6x4Xr3ZsaktS8yTWVW79gEtQ:7Dczej/2vJW2ZYxuZ/S4Xr3ZsryQWQ
TLSH
T188A3A6AF7C2EF77A2233E05E8998846A114C3D43962374F56069EB570712465FAF08BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  adb_fmkr17vgpmbb2_v37962.vbs
- Size 104KB
- SHA256 679c490a6944950e60577a42c5ef3be9ca7d7774cba0ad550defded5cc523f60
- MD5 d62b1fc36ef4bc5057ef1285f58f31f6
- SHA1 735681f1bd485752e174148882ff644d8df41c70
- SHA512 7bde15a3c177a43c99e01ccb78933ab739ecbbac93864f2ba742bd47249e5a624c9b66a8123818a2048ece1de3adc86ff5107975abb163416689999ca13e0f92
- SSDEEP 1536:7DczeRhKBnh6L2vs+W2ZYxfxwZ/6x4Xr3ZsaktS8yTWVW79gEtQ:7Dczej/2vJW2ZYxuZ/S4Xr3ZsryQWQ
- TLSH
  T188A3A6AF7C2EF77A2233E05E8998846A114C3D43962374F56069EB570712465FAF08BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery evasion execution persistence privilege_escalation revoked_codesign trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Windows security bypass
  defense_evasion trojan
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Signed with revoked ConnectWise certificate
  Binary is signed using a ConnectWise certificate revoked for key compromise.
  revoked_codesign
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Boot or Logon Autostart Execution: Authentication Package
  Suspicious Windows Authentication Registry Modification.
  persistence privilege_escalation
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2