Extracted

Extracted

• • Target
    Paystub.vbs
  • Size 6KB
  • SHA256 f346e232d99946b08347a80848a56b42a5248eb450f53c32a6fcb14f8e766199
  • MD5 03665437f76feef46da9a0926779dbda
  • SHA1 e9ba1d1a656c040839cc4cbef6640f82ebc17d45
  • SHA512 c65f60fb95630e7c4507c0fc3fde3483363f8c09e7c56eed8a4bbf7da916f5713cb1d467f8154ba83e891eec448c926243e82355fa4d980f7cf151045b945dab
  • SSDEEP 96:XuNcljSbE0fniIAXOgKGR6OzQZAd6cYmsSGRyDZxfwiLOtrwrwvsonqgEhcwoF4j:XJ2EyzoIKEpmsSxZJdzkEonqg4ToMQG
  • TLSH
    T114D1D40367EA4544B2F32F05AE7649750A27BE626D3DD60D469C1D0E1BF3988E870BB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceransomware

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2