3095bf779c5e14931e8fc6843504f79022893947742a61e0bdaba907971f4dff

Analysis

max time kernel
32s
max time network
34s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
05-07-2023 11:34

Target

adplus_old.vbs
Size

184KB
MD5

fd5fb3b20a66f045e84c6c779c6130f6
SHA1

532520d801d009f8b1807dee92b70424342979c8
SHA256

3095bf779c5e14931e8fc6843504f79022893947742a61e0bdaba907971f4dff
SHA512

57dcaef91a4247ac22dc791f4343c80a8191973306d0720e686150ab71bc81aee51ed6f8b5ce6d381918662228a03fde6cc1e350dd01fd25c83ebd752e18796b
SSDEEP

3072:z3XefUgvyiDwWY0uzB4QZvW2drHWgOOWS1K4j5cm6gucSS34A40VtEZIjgpjyzly:FgvyiDwWQulS1K4VVtvLyq2QOfb5fn

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command	WScript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "%WINDIR%\\System32\\CScript.exe //nologo \"%1\" %*"	WScript.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1252 wrote to memory of 2040	1252	WScript.exe	27
PID 1252 wrote to memory of 2040	1252	WScript.exe	27
PID 1252 wrote to memory of 2040	1252	WScript.exe	27
PID 2040 wrote to memory of 876	2040	cmd.exe	29
PID 2040 wrote to memory of 876	2040	cmd.exe	29
PID 2040 wrote to memory of 876	2040	cmd.exe	29

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact