General
- Target 12082026_1217_12082026_.DocumentRevisions-V100-staging-cHj.VBS.zip
- Size 7.7MB
- Sample260812-pgaa7atwhy
- SHA256 ed8d6b6bf388c8302b7006c436733647f74958e43a71f9ecfa28db45796342bb
Score
7/10
Malware Config
Targets
-
- Target .DocumentRevisions-V100/staging/228e81a6f91a46f1bd1d5b7fd6929c55.pdf
- Size 1KB
- SHA256 97dbce6a54d86a62945442a0ee3c228648a1712dd8b8e1772d8cb5eda5caf302
Score3/10 -
- Target .DocumentRevisions-V100/staging/cHj.VBS
- Size 548B
- SHA256 211d09e98bb8deb66b52d02cbd6f9681af63470a99a14dac76269ae6a36746d7
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Executes a VBScript file via the Windows Script Host.
-
- Target .DocumentRevisions-V100/staging/国家管网集团天然气托运商.pdf.lnk
- Size 2KB
- SHA256 39b5927587a6aed49e094745a49f3f5991ac2e7aa1ce1340aeceb1c2ae68002c
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops desktop.ini file(s)
-
- Target .DocumentRevisions-V100/staging/文档.exe
- Size 16.4MB
- SHA256 bc11857c32d57d01371ad6be4e08ef79f79bd7a847b001248474c3f05e21dbf6
Score6/10-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1