d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8

Analysis

max time kernel
150s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 18:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs
Size

13KB
MD5

36cb8b10fd1773d1b02ecce623c87139
SHA1

3955f894b2c33db46dd19d624f9ed0532eb111b6
SHA256

d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8
SHA512

f37af79927ab807ca4f015846f7e66b58011cd14b9afb161c2549f961d13e6eaaf23300066e473f909f227d42fbaf1686272957d820bc4da0c979bcf56996389
SSDEEP

384:O/zzVqiGagRYwZSFFOECXCghDSHXWmZg1r+9f7qN:6zxqagRYwZSGECXCgMmsgV/N

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs	WScript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs\""	WScript.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8 = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d28db99d6986dbf5a770ccda9ed838c163be8b72342d7f2aea785044fa17f4a8.vbs"
1⤵
- Drops startup file
- Adds Run key to start application
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...