Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-11-2022 12:46

General

  • Target

    4206af6d78d43ed97ac4105ec5a2567f208d9ff0c8a7b7855d612c16d5da93d3.vbs

  • Size

    13KB

  • MD5

    944b2b6677e062d9f84bfa643cf0e784

  • SHA1

    a1f1590f83f9639d17d45de873b99ae6f9dfb6d4

  • SHA256

    4206af6d78d43ed97ac4105ec5a2567f208d9ff0c8a7b7855d612c16d5da93d3

  • SHA512

    1cad0ac68e8e8aa9a375585f470327afee6350e8ad0d4cfbf33a5b853f98a48c7cf12414670a483d2c64d4489b142f865027e5d96e63841d5b9286700e91b107

  • SSDEEP

    384:EzzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:EzxqagRYwZSGECXCgMmsgV/N

Score
7/10

Malware Config

Signatures

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4206af6d78d43ed97ac4105ec5a2567f208d9ff0c8a7b7855d612c16d5da93d3.vbs"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    PID:1260

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads