General
- Target DocumentViewer_vRXzXHtF_2.vbs
- Size 30KB
- Sample260804-w7kyyavwe1
- SHA256 ab66ca901030b639dd32298494dd5df7ec97d79fe30783abe73126ed50d6ee08
Malware Config
Targets
-
- Target DocumentViewer_vRXzXHtF_2.vbs
- Size 30KB
- SHA256 ab66ca901030b639dd32298494dd5df7ec97d79fe30783abe73126ed50d6ee08
Score8/10-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Visual Basic
1Windows Command Shell
1Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1