Overview

overview

10

Static

static

CRA_INV_20...65.vbs

windows7-x64

10

CRA_INV_20...65.vbs

windows10-2004-x64

10

Analysis

  • max time kernel
    187s
  • max time network
    208s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-11-2022 10:27

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    CRA_INV_2019_831222351365/CRA_INV_2019_831222351365.vbs

  • Size

    24.3MB

  • MD5

    350e751bb68ade139e174d65008eebe0

  • SHA1

    f235f388686573edd1475f337c9b5b34afd4b9e1

  • SHA256

    d39e3c62fb0b70846240f3d73a3885d5024eebcc9e61fa77f5ebbb450fbf7620

  • SHA512

    3b34c36fd8e2e9b83150cfe652bc34c615b0017174f35d4ba2513d63b73aa51ae75c928f7e6307bd29d9adeb3222cb6ba8f19c0feeab53d2cf2f66ca43394f47

  • SSDEEP

    6144:tJGfk3YNoB2OmKvIbvSGF2qU4DZA3fX680UPUXzmcTc8cxhTWMRA4PZUhQKsTRIq:WnhrO

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\CRA_INV_2019_831222351365\CRA_INV_2019_831222351365.vbs"
    1⤵
    • Suspicious use of FindShellTrayWindow
    PID:4604
  • C:\Windows\system32\regsvr32.exe
    regsvr32.exe -s C:\Users\Admin\AppData\Local\Temp\qCnossAab.txt
    1⤵
    • Process spawned unexpected child process
    PID:1672
    • C:\Windows\SysWOW64\regsvr32.exe
      -s C:\Users\Admin\AppData\Local\Temp\qCnossAab.txt
      2⤵
        PID:4860

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\qCnossAab.txt
      Filesize

      1.1MB

      MD5

      f8cf63fb5f35fb0a72aeffcf1dc27aef

      SHA1

      bcf27f65d35c4ce37f0f6af6ca3f2215fbef34eb

      SHA256

      dca1194d8f8691d90bb209e4b9baae53da4d107169bda9b1d8c4a99a6316b5b9

      SHA512

      f30acf1e157b70df459ef4d133bc680c9a7f48ddd532c29fa9d27c8eb16e976f6baf4d2f701d40a8875929267f8147dc25ee960b8b7eccc20da59eeca814dc4f

      Download Submit