Overview

overview

8

Static

static

8

The_Progre...t.docm

windows10-2004-x64

1

The_Progre...t.docm

windows11-ltsc_2024-x64

1

asist_vbs_...es.vbs

windows10-2004-x64

8

asist_vbs_...es.vbs

windows11-ltsc_2024-x64

6

asist_vbs_...bs.vbs

windows10-2004-x64

7

asist_vbs_...bs.vbs

windows11-ltsc_2024-x64

5

expres.vbs

windows10-2004-x64

5

expres.vbs

windows11-ltsc_2024-x64

5

help.ps1

windows10-2004-x64

6

help.ps1

windows11-ltsc_2024-x64

6

macro.vbs

windows10-2004-x64

5

macro.vbs

windows11-ltsc_2024-x64

5

s0.js

windows10-2004-x64

3

s0.js

windows11-ltsc_2024-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    articles.zip
  • Size 709KB
  • Sample260930-phkhjsxapf
  • SHA256 4f67e0b3cfcf0297cd4cbc6449abf39962d2c40981bfd8f23a832b634e075a4a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
executionmacro

Malware Config

Targets

    • Target
      The_Progress_and_Promise_of_the_Moon-Kim_Summit.docm
    • Size 47KB
    • SHA256 57b77e4a4697d80c4d4665025903e5c78cc548000ae996541c443e2b3ce212b2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      asist_vbs_getfiles.gif
    • Size 1KB
    • SHA256 4ed4fabf3b384e943ca9af23632d751f15936545cf7fab8dfa7ed7537389c9c6
    • MD5 SHA1 SHA512 TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral3behavioral4
    • Target
      asist_vbs_redirect_vbs.gif
    • Size 630B
    • SHA256 965b827de5ad5792560af33aa8f8f775457ca60ec6135d5145646e906dab446d
    • MD5 SHA1 SHA512 TLSH
    Score
    7/10
    execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral5behavioral6
    • Target
      expres.php
    • Size 4KB
    • SHA256 c9132023f8ba0321e83fdcbaef14d23af0fec6619cc25b24316729a5fb31159e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral7behavioral8
    • Target
      help.php
    • Size 612B
    • SHA256 4887fa4373138f3e72cd584f16e55149fcd6b985585d079fb6de88a6700f0ea0
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    execution

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral10behavioral9
    • Target
      macro.vbs
    • Size 144B
    • SHA256 75f29b1e556d22f0e235bd6e4308b2bcda8111f2306e6a4c86255bae43986345
    • MD5 SHA1 SHA512 TLSH
    Score
    5/10
    execution

    • Executes a VBScript file via the Windows Script Host.

      execution
    behavioral11behavioral12
    • Target
      s0.php
    • Size 16KB
    • SHA256 289168b9d934f28e09f2786c6b054fbab493fcdc604f378973ccce4c8dd201ad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13behavioral14

MITRE ATT&CK Enterprise v16

Tasks