f782172222bd332905c9d3eac620bb83043d5d2c30482bb9cd20c98003faf7e1

Analysis

max time kernel
121s
max time network
51s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20-10-2022 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f782172222bd332905c9d3eac620bb83043d5d2c30482bb9cd20c98003faf7e1.vbs
Size

4KB
MD5

f7f0b6f9e72694a1c879daa3ce826f0a
SHA1

ed4b3e3535d97e5d87f57f4a3c80ab68cf853bf8
SHA256

f782172222bd332905c9d3eac620bb83043d5d2c30482bb9cd20c98003faf7e1
SHA512

76c9dc491c760c72b80f9ff660bb7ac0ffaabb9b17b88f76f78b7bbfcb1903b29e41a73c1d354c024c703976494136b17479639e065865f2513913ecd993b454
SSDEEP

48:HkpDi2qhvXLviovTMsV2ewUEu2TjaqH+HbUXDXsPqLle7QJvIGusqWk+uvv7:Hk8oufZ2TeqHewesvIpb+q

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RYNKSFQE = "C:\\Windows\\SYSTEM32\\RYNKSFQE.vbs"	WScript.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	WScript.exe
File opened for modification	C:\autorun.inf	WScript.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SYSTEM32\RYNKSFQE.vbs	WScript.exe
File opened for modification	C:\Windows\SYSTEM32\RYNKSFQE.vbs	WScript.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "Hacked by f782172222bd332905c9d3eac620bb83043d5d2c30482bb9cd20c98003faf7e1"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f782172222bd332905c9d3eac620bb83043d5d2c30482bb9cd20c98003faf7e1.vbs"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies Internet Explorer settings
PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads