General
- Target iacEmuMrp_v0.3.5.zip
- Size 13.1MB
- Sample260825-qfed7ayzbx
- SHA256 191d4e971251d7bb8be5a7aef0e57a5d526a58dbab9e43b9246a11abb8378dc7
Score
7/10
Malware Config
Targets
-
- Target iacEmuMrp/iacEmuMrp.exe
- Size 19.8MB
- SHA256 00c608330e11dc2eb310908b711e231a635e63f0e5fcfe155e75d0e4bda30ce6
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
- Target iacEmuMrp/双击我启动-240x320-旧版vm-dsm列表.vbs
- Size 236B
- SHA256 2bb70f7445ad98338106d613e3d0289c642497cdb1ee2adcc63096719bc48efb
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-240x320-旧版vm.vbs
- Size 249B
- SHA256 651d63f8ac0d5ef246ed86716a47668ff7a609041d3245a23c18a560fb1d7645
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-240x320-极速vm.vbs
- Size 249B
- SHA256 4bf6f040f5df307f6e2c4977f09dce27ba20d357526af80a51500b7bf482120d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-240x400-极速vm.vbs
- Size 249B
- SHA256 0c413c4cc006e441bd8594bf9bc548e75ca9eaace0f98aaea005a8f19b88bf8e
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-320x240-极速vm.vbs
- Size 249B
- SHA256 e61a3119d765e87d5938ba49545f127b919cd3d8f1453d4306206e1e473981ff
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-320x480-极速vm.vbs
- Size 249B
- SHA256 e985385542c8bbdb1f0eb8c9948b275df9a15972fdfb8f7865e3caaba7b70903
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-480x800-极速vm.vbs
- Size 246B
- SHA256 3897504419d2c459302a52e1001caa189e6959d1ef249be3f64cb7529c08b4a3
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-800x480-极速vm.vbs
- Size 246B
- SHA256 6636b3166f0a0cca2334d29d12975e0710e1267544934553b721c0d0ab3aa7af
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
-
- Target iacEmuMrp/双击我启动-800x800-极速vm.vbs
- Size 246B
- SHA256 6455973cc617487a42047b460adf31f8cf7a25b7be8b598adc59ccc8fac2f4d4
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Tasks
static1
Score
3/10
behavioral1
Score
7/10
behavioral2
Score
7/10
behavioral3
Score
7/10
behavioral4
Score
7/10
behavioral5
Score
7/10
behavioral6
Score
7/10
behavioral7
Score
7/10
behavioral8
Score
7/10
behavioral9
Score
7/10
behavioral10
Score
7/10
behavioral11
Score
7/10
behavioral12
Score
7/10
behavioral13
Score
7/10
behavioral14
Score
7/10
behavioral15
Score
7/10
behavioral16
Score
7/10
behavioral17
Score
7/10
behavioral18
Score
7/10
behavioral19
Score
7/10
behavioral20
Score
7/10