Analysis
-
max time kernel
146s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2023, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
venue-map.png.vbs
Resource
win7-20230712-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
venue-map.png.vbs
Resource
win10v2004-20230703-en
1 signatures
150 seconds
General
-
Target
venue-map.png.vbs
-
Size
53KB
-
MD5
5c06eaeae0931287b66c9288ea3d167b
-
SHA1
cac94e28bc44a1bc8cd3ae430a0375247e45576e
-
SHA256
b3f52538ed79669995c5e43ecd7bd5b369f3558dc5e5e6c82a02a7b78334f5b4
-
SHA512
28176e57301ade7d69c4a915249314707aaa6f19175c268cc64b75411e5ca71be63b62053921adccdcd19410c85310c4ddb4d3a24f0c0061288563f8faae815b
-
SSDEEP
384:oon7cCQM9z1W1kV6CDbu2HMElZNLV/lhgZLN+GmXN6FT8sAkcXYx5XQOw1xs0Az+:oicCQM9z1VDbu2HflZNLV/L6FcBAi
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 35 1256 WScript.exe 37 1256 WScript.exe 39 1256 WScript.exe 43 1256 WScript.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\venue-map.png.vbs"1⤵
- Blocklisted process makes network request
PID:1256
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2752