bef45152116c522cf2a143e4289e4b7b2ef1cf38a5d5a03efc28fac48f982a50 | Triage

Analysis

max time kernel
45s
max time network
49s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 12:51

Sharing

Report Analysis Logs

General

Target

wcli.vbs
Size

596B
MD5

d2cf5d753efcc7a97ca463d37419f09a
SHA1

899de6d941c4509054575740dc78d7c01d8ca1ab
SHA256

bef45152116c522cf2a143e4289e4b7b2ef1cf38a5d5a03efc28fac48f982a50
SHA512

30b3cdff722fe5b766195a3c3df17f4290effcba81a658f02e1f6138c3681562d24bf4208a135365a1cf2078e7aafb59b08b6cfceb63430208dce831081aea39

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	568	AUDIODG.EXE
Token: 33	568	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	568	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
632	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wcli.vbs"
1⤵
PID:1048

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2008

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wcli.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
PID:632

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2008-54-0x000007FEFBEE1000-0x000007FEFBEE3000-memory.dmp

Filesize
8KB

Download