Extracted

• • Target

    ASNQSKJPXJLKFXSIEUQYZ.VBS

  • Size

    2KB

  • MD5

    f04ca5c16f111ab69293045badd53ad9

  • SHA1

    1184fafe345b6f79d6a28d87ef957d7f96b76f52

  • SHA256

    00b3ede6f9c3073b02afc09611974bdc4765400ac8c039d620679083b88f63fe

  • SHA512

    f07b185f0b78ff3962767a7f2d85957ca9057ee049fdf90d041bd405dcc23fe2a79c71143fde8b907153942be9525941af7ffc2d9e25f6bf1717cb43990f200b

  Score

  10^/10

  nwormdownloaderworm

  • NWorm

    A TrickBot module used to propagate to vulnerable domain controllers.

    wormdownloadernworm

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2