7a4972d52dc90802c975c5ecb8f451450772170efe6b7c447cb396d5b0027059

Analysis

max time kernel
66s
max time network
66s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

HJN.VBS
Size

35KB
MD5

0a6cbbb50a759ba9029241c28f29489b
SHA1

7bce93167ad2fb200c1a9e8563a29fe9351eabfd
SHA256

7a4972d52dc90802c975c5ecb8f451450772170efe6b7c447cb396d5b0027059
SHA512

2fe56c0ed6e5c427c50ff270b24a9fe4e376c98c4e0ce502bc55accb6dc19ef958a210f147857403bdf57a40c514ba7c3cf4bfa5b7e79d48fedfeab3e5bc6b45

Score

8^/10

persistence

Malware Config

Signatures

Adds Run entry to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\HJN = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HJN.VBS\""	WScript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HJN = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\HJN.VBS\""	WScript.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJN.VBS	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJN.VBS	WScript.exe

Modifies the visibility of hidden or system files 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	WScript.exe

Deletes itself 1 IoCs

pid	Process
2564	WScript.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 816	2564	WScript.exe	67
PID 2564 wrote to memory of 816	2564	WScript.exe	67

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\HJN.VBS"
1⤵
- Adds Run entry to start application
- Drops startup file
- Modifies the visibility of hidden or system files
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Local\Temp\HJN.VBS"
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads