General
- Target owpa.txt
- Size 1KB
- Sample260906-wwj79sce76
- SHA256 c26a0e6c06cfaff5680d6ce03a1028dfe04259f0c568904dc6e3d6764a9951b1
- MD5 158c950975d9aa0a6f5b52fe345844d3
- SHA1 480668b7fcbfe533b0f7d68e2170064adf4495e9
- SHA512 76f79b85ed8cdf839aac8694f9036780fc68a57a36a414cd1df01b592cd77f945a96707454cdd7347a678e7712b35edc0fd8fe526258e15040f1735e932f6278
- TLSH T14421212A957FC9A286F4C3F942C30436E3966A3B18A28C1D798DD1022FB1375D5587FB
- MD5 SHA1 SHA512 TLSH
Score
10/10
Static task
static1
Behavioral task
behavioral1
Sample
owpa.vbs
Resource
win10v2004-20260513-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
owpa.vbs
Resource
win11ltsc2024-20260709-en
5 signatures
150 seconds
Malware Config
Targets
-
- Target owpa.txt
- Size 1KB
- SHA256 c26a0e6c06cfaff5680d6ce03a1028dfe04259f0c568904dc6e3d6764a9951b1
- MD5 158c950975d9aa0a6f5b52fe345844d3
- SHA1 480668b7fcbfe533b0f7d68e2170064adf4495e9
- SHA512 76f79b85ed8cdf839aac8694f9036780fc68a57a36a414cd1df01b592cd77f945a96707454cdd7347a678e7712b35edc0fd8fe526258e15040f1735e932f6278
- TLSH T14421212A957FC9A286F4C3F942C30436E3966A3B18A28C1D798DD1022FB1375D5587FB
- MD5 SHA1 SHA512 TLSH
Score10/10-
UAC bypass
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1