Analysis
-
max time kernel
134s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 19:10
Static task
static1
Behavioral task
behavioral1
Sample
02468574e9bd8bdb16020ec731a3d960c84710155b0e3bf8101d4ec7ca50cffc.vbs
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
02468574e9bd8bdb16020ec731a3d960c84710155b0e3bf8101d4ec7ca50cffc.vbs
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
02468574e9bd8bdb16020ec731a3d960c84710155b0e3bf8101d4ec7ca50cffc.vbs
-
Size
1KB
-
MD5
5d871b9d3abdb97236098ecd2a6de5fb
-
SHA1
06a70cae70352b524466d61b2d50a7d24df4d522
-
SHA256
02468574e9bd8bdb16020ec731a3d960c84710155b0e3bf8101d4ec7ca50cffc
-
SHA512
9f9b93dc6f608e3eb2e5c2d1092264c387beef9b99a3a92e0d414e320571ed0da3ac62339ff7de3c063e7161cf621e1220c71695fb98b6592875c396434ea789
Score
5/10
Malware Config
Signatures
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
WScript.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "c:\\windows\\bs.bmp" WScript.exe -
Drops file in Windows directory 2 IoCs
Processes:
WScript.exedescription ioc process File opened for modification C:\WINDOWS\bfsvc.dxl WScript.exe File created C:\WINDOWS\bfsvc.dxl WScript.exe -
Modifies Control Panel 2 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaperstyle = "2" WScript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\02468574e9bd8bdb16020ec731a3d960c84710155b0e3bf8101d4ec7ca50cffc.vbs"1⤵
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵