General
- Target Surveyor docs_compressed.vbs
- Size 24KB
- Sample260930-cdxk4aycnf
- SHA256 df703fb731180cfc090c985d06a5d5b0ee764b9a970c0ed7a2205ad34af48400
- MD5 0b4a5885cef0d2734853c6c81987254e
- SHA1 0210e7f225334e336375c7dd5d398b8319541fc8
- SHA512 ee89894905dfd4f9fa804178955f1e6478cb921e1642aacaec3349e93187334b96a83f71c883bfebe45ec43a042f8f17e6d9a76930de05e6b7637e12042edf3c
- SSDEEP 768:RihPBUoGmvmVOWppTrLuZynvASLsB0/PksOy:MzE3OOLPvAHBImy
- TLSH T104B24D62DE4126259D071B96984D6874EF65006601630272FEFD722E2907F6CB7BCD1F
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Surveyor docs_compressed.vbs
Resource
win10v2004-20260911-en
11 signatures
150 seconds
Malware Config
Targets
-
- Target Surveyor docs_compressed.vbs
- Size 24KB
- SHA256 df703fb731180cfc090c985d06a5d5b0ee764b9a970c0ed7a2205ad34af48400
- MD5 0b4a5885cef0d2734853c6c81987254e
- SHA1 0210e7f225334e336375c7dd5d398b8319541fc8
- SHA512 ee89894905dfd4f9fa804178955f1e6478cb921e1642aacaec3349e93187334b96a83f71c883bfebe45ec43a042f8f17e6d9a76930de05e6b7637e12042edf3c
- SSDEEP 768:RihPBUoGmvmVOWppTrLuZynvASLsB0/PksOy:MzE3OOLPvAHBImy
- TLSH T104B24D62DE4126259D071B96984D6874EF65006601630272FEFD722E2907F6CB7BCD1F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2Visual Basic
1Windows Command Shell
1