Analysis
-
max time kernel
160s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 15:48
Static task
static1
Behavioral task
behavioral1
Sample
5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs
Resource
win10v2004-20221111-en
General
-
Target
5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs
-
Size
15KB
-
MD5
acab1357b46338b09e3d86645371a77d
-
SHA1
05dd85b66d993265fa6216a610ea874853206c0f
-
SHA256
5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79
-
SHA512
73e19b2c91188e964323bc0415afbeb0f4672b1b310475cc7072f39c1a9ac334b3d3c5d8631f7d8b32d8939f7f221854ca36780f0e4d0fd7dc4f985f18b62a72
-
SSDEEP
384:g+xzAiGagRYwZSFFOECXCghDIHXWmAgF9f7qtOkLT:gE4agRYwZSGECXCgumxgetOkLT
Malware Config
Signatures
-
Blocklisted process makes network request 7 IoCs
Processes:
WScript.exeflow pid process 14 1480 WScript.exe 35 1480 WScript.exe 53 1480 WScript.exe 72 1480 WScript.exe 86 1480 WScript.exe 93 1480 WScript.exe 98 1480 WScript.exe -
Drops startup file 2 IoCs
Processes:
WScript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs WScript.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
WScript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs\"" WScript.exe Key created \REGISTRY\MACHINE\software\microsoft\windows\currentversion\run WScript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\5d1dc98fc2a1abd3255ecdda7a4f0d26b8e4ca89c9f04dfb870f7a548adfbd79.vbs\"" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.