ea4541881007953039268e1ca2263647632bb8fb5c08164b180d1883e740e150 | Triage

Analysis

max time kernel
135s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2023, 01:01

Sharing

Report Analysis Logs

General

Target

Claim_C736.wsf
Size

60KB
MD5

ab56f73616cb46052b1216a5215a0b04
SHA1

a8a47d321dbd6b768d1d4dab7480ac6b947c1600
SHA256

21655aa8370b5541fbaebb6b02da5eb294eaf82066ab42889b8df15a709fb5c3
SHA512

378b54053f6e0fea6205952920a281b2769e7ad135c8b933f34a845511312277734afe940f1210b8e009cc1e2ebbda8de191ac53f3d1c1d75ef45241fb6887bd
SSDEEP

1536:vVqqMgLjJvyKjIXHWmmm/g3ueag8WSZT5xMJ1ZOv1Ic6:Aux0X/bg3Xag/SZNxMJ1ZOv1It

Score

10^/10

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4700	5080	conhost.exe	54

Blocklisted process makes network request 6 IoCs

flow	pid	Process
6	3872	WScript.exe
8	3872	WScript.exe
29	3872	WScript.exe
30	3872	WScript.exe
31	3872	WScript.exe
32	3872	WScript.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 4596	4700	conhost.exe	89
PID 4700 wrote to memory of 4596	4700	conhost.exe	89

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Claim_C736.wsf"
1⤵
- Blocklisted process makes network request
PID:3872

C:\Windows\system32\conhost.exe
conhost.exe rundll32.exe C:\Users\Public\amLE5PKlGAXrhpU.dat,bind
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Public\amLE5PKlGAXrhpU.dat,bind
  2⤵
  PID:4596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads