Extracted

Extracted

Extracted

• • Target
    nfe_toweb_brasil_ltda_epp.vbs
  • Size 45KB
  • SHA256 8f32d30e23cdf103109afc2c5d3d4445f95c25ca0ce44cbf60cd014a100beb09
  • MD5 d7ab62783d5f52b03df5bb2b78c298ce
  • SHA1 4f1a349fcdb827ef2ae5857437a762862b504cff
  • SHA512 20e0b8e7817f276933dcfb919bfc182659c45624bf70339acb22bfd93fb9944834b329ec3e1ffb1ff2a2751e1e7e9464d559d2ee22980b25b41c9cb219d55b3a
  • SSDEEP 384:+QJzDeqoLMlw9ji3UJMPghpY/4W+16V/SQYC5Ir8lkIgwUBv1VPJEEnvMho3LsA6:+QAlLMlQjaM2LdSQErIgp7VPqO0+Twf
  • TLSH
    T15823E23E4C1102FB12FAC718E7DC1A0BF961F957B2A9AD0DC0C74786669324BB5C926D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionpersistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2