General
- Target Suivi_de_Votre_Colis_.zip
- Size 2KB
- Sample261102-pk4dfaws3k
- SHA256 859886a6bcaf61007a2688f7e9632b69d1dcd5e853ebd49be7499590745f4f89
- MD5 cb04fedb1dac8b6a7043e8e707f54aad
- SHA1 14cad80721353f5558a00e0d50f44b380b144db2
- SHA512 f36d8f67d9ca3b8e44e7d791471c8017460d5482f353d061255cca3fd8be9de5fbf238cca1e1c21e35e1dd71609408b3aa9cd47b6b840f688dc01e50b694a2f5
- TLSH T1B1512A921A4BD3D0DCB87BB225B5C2E3133760D8263026A5260468256E9B2F97D70977
- MD5 SHA1 SHA512 TLSH
Static task
static1
Behavioral task
behavioral1
Sample
Suivi-de-Votre-Colis-.vbs
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
Suivi-de-Votre-Colis-.vbs
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target Suivi-de-Votre-Colis-.vbs
- Size 10KB
- SHA256 c246054359eb47b2dbb6768941ba69274d593fd1a6a9a7378ec4cbf2f656b2f8
- MD5 5ffb9f94703893808675838aff352ad6
- SHA1 88f31a56ef607c05882a4e7627187c7f5c20b39c
- SHA512 41e4fa80216e180647b91f4d2c1266c5876e2ca7061ee014221f725bbca751b08165370e27833d2669487b8d9dc70d253d30934e88ee09cf4db5026032234dbc
- SSDEEP 192:/r8TlkLSqvpUNFu5ZMRJDqyHiK28cQUdCcKLYJPjBJPjaUeOZOHV:/rY+3pqYXMRJDqyHiK28zyCcKQPjPxs1
- TLSH T1A232525C1110920D14609BE14C6BE48D649AA2F69BCA19FC43F3FE0C37DDDE5A8A52BF
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Creates a file in the Startup directory
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
-
Adds Run key to start application
-
Executes a VBScript file via the Windows Script Host.
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Visual Basic
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1