04d8a5b5e8ce9d24170423c8e7a2595ea5f5fabdb87853b22e5207b46fb3626f

Analysis

max time kernel
165s
max time network
172s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2023 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fclear...vbs/FClear.vbs
Size

17KB
MD5

fcc7be78c9e643b651aec9d6a53c610a
SHA1

c3c0426d43d2a8dafa08f82486873d91a51a5462
SHA256

626b0b61814000bda6e46458066f06da7cd6948d8685681e18cf132610a86199
SHA512

08d103320d8bb7fd4f1999fbd9897a8142976ced0ca3a53ee533ba4c0336be0e8fccdb267c04f271ea08be36b314fbbf44c84d9dd125f60682dc0c56537c57f1
SSDEEP

192:+EabvDUPa/n5ArRNv3bNv13JCyUkglnSTYXHkVPSVB6Rb7rLoJp3l6EfmbQ0xazw:+trE1rbxUVSmkVPYGQDeNBTN0Nu

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4484	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
4968	tasklist.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	tasklist.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 2972	1352	WScript.exe	87
PID 1352 wrote to memory of 2972	1352	WScript.exe	87
PID 2972 wrote to memory of 4968	2972	cmd.exe	89
PID 2972 wrote to memory of 4968	2972	cmd.exe	89
PID 1352 wrote to memory of 3648	1352	WScript.exe	92
PID 1352 wrote to memory of 3648	1352	WScript.exe	92
PID 3648 wrote to memory of 4484	3648	cmd.exe	94
PID 3648 wrote to memory of 4484	3648	cmd.exe	94

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4484	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fclear...vbs\FClear.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c tasklist > C:\task.fcl
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4968
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c attrib +s +r +h C:\FClear.vbs
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\attrib.exe
    attrib +s +r +h C:\FClear.vbs
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\FClear.vbs

Filesize
17KB

MD5
fcc7be78c9e643b651aec9d6a53c610a

SHA1
c3c0426d43d2a8dafa08f82486873d91a51a5462

SHA256
626b0b61814000bda6e46458066f06da7cd6948d8685681e18cf132610a86199

SHA512
08d103320d8bb7fd4f1999fbd9897a8142976ced0ca3a53ee533ba4c0336be0e8fccdb267c04f271ea08be36b314fbbf44c84d9dd125f60682dc0c56537c57f1

Download Submit
C:\task.fcl

Filesize
7KB

MD5
75e49f01a087fa5cb1d3d067547889b5

SHA1
6989ed4847d9deff0ff92b6ccd0bf241a7614a79

SHA256
c2db0b730e394572747bebaf541104a5814c63cf45af4ea9bd25506e06de6efc

SHA512
71d723868d22c30e199a5e7e19805e5fff1df33d593f964c8c7370dfa26ff4c14d6ae7a9e0343f116273ad8b17cca686fc951a6c08bff5b3ef9c5d280601d10f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads