9d1005c626dd7abe8c41ea1a47f329960efc2bd5e4a13b2d2de0bcca9ef43212

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/01/2024, 14:40

Target

58f71f47f5370aebe1ca5cf7edbb78e6.vbs
Size

2KB
MD5

58f71f47f5370aebe1ca5cf7edbb78e6
SHA1

9adf0f51222178776b16ff45de130dfc65b06d90
SHA256

9d1005c626dd7abe8c41ea1a47f329960efc2bd5e4a13b2d2de0bcca9ef43212
SHA512

4fa32525ceed265a94a2f3a97826f1df65951bfb58bd702d09585954352268296051f308ad75152cbfcf29d3bef9e8c667eb4a8f5ad3340c5e88e2bb89dd0bce

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 280	2528	WScript.exe	28
PID 2528 wrote to memory of 280	2528	WScript.exe	28
PID 2528 wrote to memory of 280	2528	WScript.exe	28
PID 2528 wrote to memory of 2688	2528	WScript.exe	30
PID 2528 wrote to memory of 2688	2528	WScript.exe	30
PID 2528 wrote to memory of 2688	2528	WScript.exe	30
PID 2688 wrote to memory of 2740	2688	cmd.exe	32
PID 2688 wrote to memory of 2740	2688	cmd.exe	32
PID 2688 wrote to memory of 2740	2688	cmd.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\58f71f47f5370aebe1ca5cf7edbb78e6.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c RPC.exe SD.exe
  2⤵
  PID:280
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c find log.txt "[VULN]" >logg.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\system32\find.exe
    find log.txt "[VULN]"
    3⤵
    PID:2740

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact