366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da

Analysis

max time kernel
154s
max time network
160s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs
Size

13KB
MD5

ceaeb666ff632a90ca58cba66b0afbe4
SHA1

fa46e6928dd49a7d62312424e89366fbb7f9fb52
SHA256

366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da
SHA512

4406862ec88a02dcc786ff60e4fe965a6f6def63ebe53382c6802eba432f29aeded0d32e1059b554ff2f211fdbd473a121710248cbe16a28c43a8c3488fe4730
SSDEEP

384:OOzzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:nzxqagRYwZSGECXCgMmsgV/N

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\366616f32f718d996cf4f967cb5cd0e95c61e4ce046e848da46f5c358c8c31da.vbs"
1⤵
- Drops startup file
- Adds Run key to start application
PID:1228

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1228-54-0x000007FEFB631000-0x000007FEFB633000-memory.dmp

Filesize
8KB

Download