a4629531197db10426b08e8279581582955e0164e35d88c1e21366ae8c8e4458 | Triage

Analysis

max time kernel
278s
max time network
320s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
24/11/2022, 09:01 UTC

Sharing

Report Analysis Logs

General

Target

White-Crypt/Modulos/mdlSandBox.vbs
Size

6KB
MD5

78240c0dcd87924d7ca671e0003e4194
SHA1

7be38a76d71826d24740d4c57e799c96fddb30c7
SHA256

4f947085c46f9e60a350fe71d1fa0ee1127e93db912fb2ee9715d6c98177a6a2
SHA512

ab4f5591f9a97f2fc2df8903e67595f54b3c4f2040686e6da84fefa4f647b166b84464afdcb793ac284dbd7f1e97e9eab519344f4760b2b4090cadec5f036ace
SSDEEP

96:OJQeaor+K4X0gtk3+byx5qWpGnSww5euxUksFxVI44yWa3tyVO5J/Ne+mFLv9/o9:Omox55sjVFkrqty0b/gfF/WNL/B

Score

1^/10

Malware Config

Signatures

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\White-Crypt\Modulos\mdlSandBox.vbs"
1⤵
PID:1988

Network

DNS

164.2.77.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

164.2.77.40.in-addr.arpa

IN PTR

Response
DNS

176.122.125.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

176.122.125.40.in-addr.arpa

IN PTR

Response

93.184.220.29:80

322 B
7
8.248.99.254:80

322 B
7
8.248.99.254:80

322 B
7
8.248.99.254:80

322 B
7
104.80.225.205:443

322 B
7
20.189.173.7:443

322 B
7
8.248.99.254:80

322 B
7
8.248.99.254:80

322 B
7
8.248.99.254:80

322 B
7

8.8.8.8:53

164.2.77.40.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

164.2.77.40.in-addr.arpa
8.8.8.8:53

176.122.125.40.in-addr.arpa

dns

73 B
159 B
1
1

DNS Request

176.122.125.40.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads