9956c157c533c41b7ff24db1636dcd84b522aab216174ea3a5b31ea2967b59b7

Analysis

max time kernel
89s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
02/02/2024, 22:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9956c157c533c41b7ff24db1636dcd84b522aab216174ea3a5b31ea2967b59b7.vbs
Size

1KB
MD5

b74ce214be7a8b22bdc7e80ee8850b65
SHA1

a17dc4ba97974651bb6e3ead56fd5abd210ee22a
SHA256

9956c157c533c41b7ff24db1636dcd84b522aab216174ea3a5b31ea2967b59b7
SHA512

c532482386cd790c2b71ed907f385e161b2f3860fbbf5844d14736b260a295972ccf6d5501f2ea0661d755b1154200bedff07c1a0ede30b4ef59ee20a57c7911

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysw32 = "C:\\sysw32.vbs"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\9956c157c533c41b7ff24db1636dcd84b522aab216174ea3a5b31ea2967b59b7.vbs"
1⤵
- Adds Run key to start application
PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads