9d4f43b21e35b9373aac0f4b3335c8b07887121168158cf4a378436a90152fba

Analysis

max time kernel
140s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2022, 07:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DINAHALAC_DOKUMENT_307891_4684203_RNGPRV_NEW_UPDATED_ORDER_DOO_AVAILABLE.vbs
Size

3KB
MD5

31439fb7f79009fbed1abfeeb4d4a35b
SHA1

0a7b86b5b5633ef29bf928c5b7f4649225ee0aee
SHA256

55f287c30331608f0796a2c9bda16a5a9429b7cb0c8d3928d2ee63184bfce9fb
SHA512

de6af2f4119cadcfaa72c50c415e1105784794e345041058fc424d02d43e55ebd7112b499d460e376c400372906b396097183865892736d5cbc2dd289ca55691

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
6	904	WScript.exe
9	904	WScript.exe
16	904	WScript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1108	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 1108	904	WScript.exe	83
PID 904 wrote to memory of 1108	904	WScript.exe	83

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\DINAHALAC_DOKUMENT_307891_4684203_RNGPRV_NEW_UPDATED_ORDER_DOO_AVAILABLE.vbs"
1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c move "C:\Users\Admin\AppData\Local\Temp\DINAHALAC_DOKUMENT_307891_4684203_RNGPRV_NEW_UPDATED_ORDER_DOO_AVAILABLE.vbs" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
  2⤵
  - Suspicious behavior: RenamesItself
  PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...