Extracted

• • Target
    Voic_0205.vbs
  • Size 2KB
  • SHA256 d8020722cb2d018613f4316ce8fc3c3e544983d24e6b20d5e995ec94a897009b
  • MD5 357321848c3c5f549a790ab72fc0d040
  • SHA1 74e2b315925a68d586d328ec11c686d5abc8fd3d
  • SHA512 8c41fcd707ad1dc644a1296cab8c25926709fff324c7dbc2c262562de208e968aeff1bdc62d1d6af457d4990445447752d800b73d7607fb008dffe700da1147a
  • TLSH
    T144412646DA0FFD508BE6A1638157964CFAA482135511483E7E9DC4CDCF1215CCBC8EDE
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  execution

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2