f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c

Analysis

max time kernel
190s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
28-11-2022 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs
Size

146KB
MD5

800e51c2fdc60549c60091bb5a128394
SHA1

1845a0b766505a848c9d509161d43601d2533e0b
SHA256

f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c
SHA512

441902d4988bb6100904f0b2fad80691723364779ed86f4d3d1b0c024a98ce165a3254228c5543a09d4ed0ef54b4b9af554c12defdf12f3a0fbc9ac7a43a38a6
SSDEEP

3072:tbNpi9Yku0lZD5jKk1RUgYYC1oPx56uzX:tTfMpxLOgD

Score

7^/10

persistence

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

WScript.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs\""	WScript.exe
Key created	\REGISTRY\MACHINE\software\microsoft\windows\currentversion\run	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c = "wscript.exe //B \"C:\\Users\\Admin\\AppData\\Local\\Temp\\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs\""	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f49a277d628fca04313f2ba599ce2e823b0e6a90f351a5e5240e78819ae8381c.vbs"
1⤵
- Drops startup file
- Adds Run key to start application
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads