9f732f21cd6bea13a4dbabbf90aa687cafd5b4b530ec27066152479e37f4cec8

Analysis

max time kernel
112s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 06:33

Target

document.vbs
Size

9KB
MD5

f433d8822f70bc508a0283099a8909f2
SHA1

5c32b5347f100127a7888a367a5f0e808125d841
SHA256

98667994f4d83f11bc5bba249a5d046314541621a0fa6da9d18117ec1e20e090
SHA512

80c2bb7382b30ba2f13635d09c9c06557ceea13cf55b40221aaeb191317e6ed020b4f1459152d74952d2e5f00f9c9c791e8c5dad2882e420a05646fc62f8c112
SSDEEP

192:ReSjpUorcl/E4hp3aD/OCMhiEe1mUS1G0vdzgW20fkbsgTbpQt:c4pnrcpE4hpPCMhidmnGm80jWb4

Score

7^/10

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

WScript.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

WScript.exerundll32.exe

description	pid	process	target process
PID 800 wrote to memory of 2436	800	WScript.exe	rundll32.exe
PID 800 wrote to memory of 2436	800	WScript.exe	rundll32.exe
PID 2436 wrote to memory of 2368	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2368	2436	rundll32.exe	rundll32.exe
PID 2436 wrote to memory of 2368	2436	rundll32.exe	rundll32.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" overhauled\\honorary.temp,CuMode
2⤵
- Suspicious use of WriteProcessMemory
PID:2436

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" overhauled\\honorary.temp,CuMode
3⤵
PID:2368

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact