31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98

Analysis

max time kernel
50s
max time network
154s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
23-03-2023 05:54

Target

31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98.vbs
Size

88KB
MD5

9eae6f49a02d6eb9f75af7bbf4349808
SHA1

2caf7ddeb9fc1d6076558661ef69b9638cfd2e7b
SHA256

31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98
SHA512

37b45c58efd8c2bee66c30bca4a3777d5b6ba39e97d34baa8e7bc27fb083397d818a2708cbcf7d4704398fdfff4cbc17abff68b33294292413527702c1ad7eef
SSDEEP

768:vvQxmTUdOGFf77IlCpfj2d7gtD/uqDX4l8EE1:vvQxxOGV77Fj2sDRX4lG1

Score

8^/10

Blocklisted process makes network request 7 IoCs

Processes:

wscript.exe

flow pid process

2 2072 wscript.exe
4 2072 wscript.exe
6 2072 wscript.exe
8 2072 wscript.exe
10 2072 wscript.exe
12 2072 wscript.exe
14 2072 wscript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Script User-Agent 7 IoCs

Uses user-agent string associated with script host/environment.

Processes:

description	flow	ioc
HTTP User-Agent header	2	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	6	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	10	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	12	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	14	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 2 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1684 wrote to memory of 2072	1684	WScript.exe	wscript.exe
PID 1684 wrote to memory of 2072	1684	WScript.exe	wscript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\31fb4bf411dcd7fcb860bdb1db26859290b047b39b94638a7d4fd2a46d323e98.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\System32\wscript.exe
  "C:\Windows\System32\wscript.exe" //E:vbscript C:\Users\Admin\AppData\Local\Temp\rad40E85FAFFdarradD0C5E133Adar.txt
  2⤵
  - Blocklisted process makes network request
  PID:2072

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\rad40E85FAFFdarradD0C5E133Adar.txt

Filesize
61KB

MD5
1aa67b0b904cd763bc3818467b021b3c

SHA1
687946e6661f96d332b8e57cab5ab2e84ca17071

SHA256
0fc30c263b4e947d2b4f7ca5e1ee57e2aa4a4e885796f15cd3e16fb03f255716

SHA512
9f8d53567998c8beb7977c470e09d4ad1a41da2555d6b7ca0b7525f70f6bba5f818aaf9a5dcbb57c7b9842e937eb5a7a64f45394f42afb2a78b09dee1493a7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\radA54DC.tmp.zip

Filesize
10B

MD5
7605968e79d0ca095ab1231486d2b814

SHA1
a007b420d19ceefa840f0373e050e3b51a4ab480

SHA256
493fda53120050f85836032324409be6c6484f90a0755ae0c6a673ba7626818b

SHA512
769249da7ed6c6bf5671bbc2371a6453b433226ceb8c4c2aa3604000d66647bcec83dee1ab64c0262fa40f923d77e23bad2c47274d339effc51d904ce77072a6

Download Submit