f1cf17385d9ca2d168e4ccde38f426ec8f9f27b9599d3974c53008e79595fc7b | Triage

Resubmissions

02-05-2023 17:07

230502-vm8zlabg49 10

02-05-2023 16:57

230502-vgr4wsbg44 10

Analysis

max time kernel
135s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
02-05-2023 16:57

Sharing

Report Analysis Logs

General

Target

A401.wsf
Size

38KB
MD5

99836f4f236daff04b190f0bd6359ff7
SHA1

ec550a41c011568c6f6fdaa0b3f1e9735b5d289c
SHA256

104a969604a948f31314155205803b2446c620f6f5dd5b438e26e189febf57b9
SHA512

7a339e43e6764fc6e901abf36cfccd36df44d4a44a5782e8bd62ed84a5ed4167288b1b7af674db997e10397f4b5fa789485b1574052fcc493e57f9606282e445
SSDEEP

768:P+UdUbjIwgTC1CkQiUzV3JIm3DfTx4SFPC7JA2mHXD8tGb+hWX1ZOWOK:PN0jId+1xQiUbT3DbuBAVp1ZOVK

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	1940	rundll32.exe	20

Blocklisted process makes network request 3 IoCs

flow	pid	Process
5	2752	WScript.exe
8	2752	WScript.exe
10	2752	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\A401.wsf"
1⤵
- Blocklisted process makes network request
PID:2752

C:\Windows\SysWOW64\rundll32.exe
C:\\Windows\\SysWOW64\\rundll32.exe C:\ProgramData\aWSHfaEX8tgUhAD.dat,Time
1⤵
- Process spawned unexpected child process
PID:2100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads