3346fb7e363282a6929b62deb57a133f6143811eefd9d58010bef3836abe02f4

General

Target
ORDER#02102026-79065.PDF.vbs
Size 812KB
Sample261002-pk65bswtfx
SHA256 3346fb7e363282a6929b62deb57a133f6143811eefd9d58010bef3836abe02f4
MD5 b599085ee41d823f0edad2cc4c58ef99
SHA1 631b29f5638ecc053f0eb091654a47cbbd5edfb5
SHA512 7dd58f7d99236cb98be2f571a66a2d93459ac13353caea2a123dd536d302300929d06bca6cf1278955a38ac7f8f0243fce0b47b9a2af293dea4a5186926c93ea
SSDEEP 12288:TATaOJ6Ec6ndaR+E/JeNr/CPb6qJbOX+lAzqbUyBE/RMyA4agq1lTG:8OOJ6j6dw1INr/Dq1PwlpMypazlTG
TLSH
T19A05C0557EAC3A729FE81B0C61FF1E0E03E0614A2845309EE6599F5F5EF3A84484F1E6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	write.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	WScript.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
2460	write.exe
2248	svchost.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
5912	WScript.exe
3736	WScript.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	write.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings	WScript.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe
2248	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
692	wordpad.exe
692	wordpad.exe
692	wordpad.exe
692	wordpad.exe
692	wordpad.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5912 wrote to memory of 3736	5912	WScript.exe	85
PID 3736 wrote to memory of 5416	3736	WScript.exe	86
PID 3736 wrote to memory of 2000	3736	WScript.exe	87
PID 5416 wrote to memory of 2460	5416	WScript.exe	88
PID 2000 wrote to memory of 2248	2000	WScript.exe	89
PID 2460 wrote to memory of 692	2460	write.exe	90
PID 692 wrote to memory of 808	692	wordpad.exe	91

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ORDER#02102026-79065.PDF.vbs"
1⤵
- Checks computer location settings
- Executes a VBScript file via the Windows Script Host.
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5912
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\qSgj.vbs"
  2⤵
  - Checks computer location settings
  - Executes a VBScript file via the Windows Script Host.
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3736
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\write.js"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\write.exe
      "C:\Users\Admin\AppData\Local\Temp\write.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2460
    - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
        
        "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:692
      - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        6⤵
        
        PID:808
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\audio.js"
    3⤵
    - Checks computer location settings
    - Executes a file named after a Windows system binary
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      4⤵
      Executes a file named after a Windows system binary
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2248

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2

T1059

JavaScript

1

T1059.007

Visual Basic

1

T1059.005

Persistence

Privilege Escalation

Defense Evasion

Masquerading

1

T1036

Match Legitimate Name or Location

1

T1036.005

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

audio.js

Path C:\Users\Admin\AppData\Local\Temp\audio.js
Size 374KB
SHA256 9c2655dd8ff03246a0ee7aef7348f5ce4b86f41ce7b364134de645d42d778636
MD5 28c0daf2d6f3467cfba2af91ab9da259
SHA1 656bcbc53792222b4c8e7b33b5c59e4332d942bd
SHA512 657f4647d36cd958f2b25e13a49d58e1af87857719d3f0f51483fbba367ecd4de161c0f16b60d4270186d1c86b3a3f9551b295df86b5afa35120745cf14b5d85
SSDEEP 6144:Au5Xrq7EYrmCskGYxANepOD8UJ0nxCjyT7RY51RNmTie47QY6ljtYoizHs7+MK7q:XbKELUANepy83nGRNmTMQYSwzHs7Ixch
TLSH
T10B84233085DF5D19275662BDE32F0139CF68BC8784A9112856E1FAE307AD30D8F9E879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qSgj.vbs

Path C:\Users\Admin\AppData\Local\Temp\qSgj.vbs
Size 600KB
SHA256 3a0f758862d6bbd61b767d63ecb8951573ac6bfc655a1bee6730f9a6152db758
MD5 dc61c8b0246558e883856088eb75338d
SHA1 b98eebce6bb90baa7b8d00fc1fa23e2f0169bbae
SHA512 7557d72d8c24447725d2526a541afd8d45a44480492ecac97fdd2f8436d36d825c44a7fe485fa42a24063e6d9918a590bcad794d0c21e8287539f69526d45bcb
SSDEEP 12288:yOr23tyS4C4SgL55HWQchcOXgm+eP6zJwCB/8giZ4hxIY2MdK:itTTRrcIV8/8PZIxI2Q
TLSH
T18FD4F11087843EA8DFAC461BC0BE261D53B05B8EC52674CEAF637D47AFAFD840617499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 280KB
SHA256 140a2b7ff0068183429a3e7783623394f82ee2a9d0f725beedce6c54430524a2
MD5 7b784e84c211dbdc94f2b19039b176f0
SHA1 ca1044fcbf781e3e3a6a7e0a6f5294760371ed65
SHA512 b5ffa16c9a73ba55fa6248ec423fee2ba868c470571ecb63b88e44cfe09b575782f22f199c934a8364e9fd85922f41c649733bd2d8061a6a5c2741847241bedc
SSDEEP 6144:eLoIbtXtzqcIox8zKvHIgR4QpsJ8FJt8e+XB9fI2imGzwFBI:y9zqc9iK/NREJ8FJt9oBy2Az
TLSH
T1AD542208B3267492D1D3D8F369FB1156C632963022DC2A17F7F495B1A2B8BE6F494723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

write.exe

Path C:\Users\Admin\AppData\Local\Temp\write.exe
Size 9KB
SHA256 45bd87a5803916409a0d824beefafb1faf49d52e0ba9c0e8014e82eaa17e7659
MD5 6e8eacc0b339365d79a2c06896865d3d
SHA1 1135aa3554ff08fbb37f8ca35c581bafd646be53
SHA512 41cf629e82d4a0f052fdc63c041149963f12e0ab75564d0ad6c0a4487265c93d666dcfc01730ce4f2c41f65534fe44d1856a52f2f79f341ee4558038d6d9682c
SSDEEP 96:ele/aViWUEsLxIZR21uGVJzjVAVN+DJdMi2bKveLrxuJRd5EWxaOWwug6:ele/SiWUfLLJzjVMNsPuxu/oWxaOWDg
TLSH
T17812C542B76DC62AE07E017148B7871169287D206F0543FB31CCB75E6F716868DB22AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

write.js

Path C:\Users\Admin\AppData\Local\Temp\write.js
Size 12KB
SHA256 048b2735a7741288164eaac5eb4ccbb3d2a62b97a47fad688b74061d38260091
MD5 b33c096a7a11e22ac566ce087e863b9a
SHA1 b139b4e90eb4a2f60ea26dc3d973be7ef06e9f6a
SHA512 b0aa19989e7a28d77a89b4cbc285e85bf026d65dd0669cdb54008e48999c713e29857179e5f180d220536cc1b272690c7f3e1b570774ab0fddb80b61747e2005
SSDEEP 192:i3neGVC+8rLk0P75o0x0bv1UHZqOt1UjKBVJvsZt5wSxrfDDRVRW3dYsQBtoE:mnxpIH071OkyvGx7DDRV2Y1BtoE
TLSH
T16252EA334A07BE67672D79469D4C2D915CAC1E8BD33086D8FB4070B265A9610DF9CCB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads