Analysis

  • max time kernel
    44s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 14:39

General

  • Target

    答复 CONFIRMATION OF ORDER.vbs

  • Size

    654KB

  • MD5

    c27f7a38b0661de03b69afe76b9697f4

  • SHA1

    36fea8822c1b4d33b405c2ab16423ea6c2a02736

  • SHA256

    d27c6afe237a969751b1e44c98fcd78f93623816162ac349703e9f3f39e542d1

  • SHA512

    56dcc44ac0b0dfcc076cec07eef693928903992cc80fdb0942068dca59f69a0cc6baa3370f3fa9b2865e47f3540de15bd284ae396e42b25421ca57eda5b1f8b2

  • SSDEEP

    12288:1ctF/y6uBCMyplUUb4eK9hjS1cpeMpWKLHFPwC9kxXKxMj3:1v6i0lPLYhW9aLHFPoZKxMj3

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\答复 CONFIRMATION OF ORDER.vbs"
    1⤵
    • Blocklisted process makes network request
    • Modifies system certificate store
    PID:1600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads