d4733ea36948a5c2e37e8d3286348295f2b4a21092edeed927abdaa15e5b7da8

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/11/2023, 12:40

Target

database_syn.vbs
Size

96B
MD5

536a9546787be5dc0f60e72aa40b7e37
SHA1

218d4f44456207583857233ae65a8850944b0c89
SHA256

d4733ea36948a5c2e37e8d3286348295f2b4a21092edeed927abdaa15e5b7da8
SHA512

dc6f01c2f703183011cf81e79a846ab2965589753d32460426b15aba000d99e044187ebb3184c4b77b5856885cc1212c79eafcdfe8f38d7d8071b0b9005cd024

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1452	2148	WScript.exe	28
PID 2148 wrote to memory of 1452	2148	WScript.exe	28
PID 2148 wrote to memory of 1452	2148	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\database_syn.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c D:\TWAMPd\htdocs\database_syn.bat
  2⤵
  PID:1452

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact