13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee

Analysis

max time kernel
93s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
14-07-2022 06:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee.vbs
Size

579KB
MD5

d4bfbd62db6574ae4a90a0c2a9fd8427
SHA1

cc7c9ca8679b2efe00d18048b8a0beadc2d53cc9
SHA256

13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee
SHA512

f8cfc582aad8e09685538e1059d1e4ce154043e12ae477b809391ebaac777bc38eda82b6e4e1c282808702ef80f128d17714d4c43510653fd0929529ed1ce009

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3980	3404	regsvr32.exe	34

Loads dropped DLL 1 IoCs

pid	Process
4996	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1496	WScript.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 4996	3980	regsvr32.exe	80
PID 3980 wrote to memory of 4996	3980	regsvr32.exe	80
PID 3980 wrote to memory of 4996	3980	regsvr32.exe	80

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\13aa175c12cd675b2a32d5bd252d35352811a036046e042ac5d1454957972bee.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
PID:1496

C:\Windows\system32\regsvr32.exe
regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\SysWOW64\regsvr32.exe
  -s C:\Users\Admin\AppData\Local\Temp\htHvf.txt
  2⤵
  - Loads dropped DLL
  PID:4996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit
C:\Users\Admin\AppData\Local\Temp\htHvf.txt

Filesize
136KB

MD5
dda7f3bb9dee24e6e2564ed656f1bf64

SHA1
e1ff05e4be55cae9a5d2035f40e923bbdda4b90c

SHA256
42cb082a5dcb4ef8a553d38b15f87aa0f5f408a8b78adf3320288320fac5c24d

SHA512
b832c2967366b62ccdb6d14f9ab22ce9b42862a2261aefd21bdc43bb1c8d2938ba91e85cd9f94a48a721a220df202866635f7c2dd20a9faa528eb1484fa77753

Download Submit