Analysis
-
max time kernel
65s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
08/02/2023, 00:24
General
-
Target
install.vbs
-
Size
199B
-
MD5
baa56acaee0b5897699a8ba340744eea
-
SHA1
63c32a3f7d0ace96f52ddf84445b18b319c79d26
-
SHA256
072b492a6a95545c6e46fbd8ca0c194173c3437c0cca8eca807c7db103e89d27
-
SHA512
f22e2510b9fae47545ced91e3464121f103a9a3c56c3da1a58719942d4f313f4d7dab2d1a579a29c915b70f6d32b901db83a0e18521ff875e4f4f90fa9825c95
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass $a='ReadAllText';$T='C:\Users\Public\Music\install.ps1';IEx([IO.File]::$a($T))2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB