General
-
Target
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
-
Size
186KB
-
Sample
240626-rdcm9a1alj
-
MD5
24cf2fb7a16835406fbb8110f7728d06
-
SHA1
c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
-
SHA256
c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
-
SHA512
85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
-
SSDEEP
3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD
Static task
static1
Behavioral task
behavioral1
Sample
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
Maersk_Pre_awb_samedaydelivery_63648938475939020000.vbs
-
Size
186KB
-
MD5
24cf2fb7a16835406fbb8110f7728d06
-
SHA1
c86b83506bcd6e6a5e72dd59b80f6d73fe7acd1c
-
SHA256
c6264b70bc76be0d3d1d461e357db3b0fa9397fd7fd70740824dea2663abf4c0
-
SHA512
85c37a37fd4e63f9add57055f65f887c5f21f37ff66caae518508b2e0e815a9daa14db8dbbf6dfa8162cb127d2d7f834d61c17dd707da8caf396cf46075ed936
-
SSDEEP
3072:5mN8GGebKjeK3ubth+DCFxKCvBB/WnHPP1w/sLJFJ281QIHz1y8mNy7Ey1MgKTZw:508GxbKja3+DCbKCvBB/WnHXC/sLJFJD
Score10/10-
Blocklisted process makes network request
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Suspicious use of NtCreateThreadExHideFromDebugger
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
Suspicious use of SetThreadContext
-