5d6f7cb48daf706c2d965d61df503915013c91d4cbf6e8ed26170cb66538e2c2

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02/02/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5d6f7cb48daf706c2d965d61df503915013c91d4cbf6e8ed26170cb66538e2c2.vbs
Size

2KB
MD5

d47bbf09e98589074fb9d09380fd8b24
SHA1

ab468ef17a81a1a4a6fb4f6e5648dbd9b1ad0d8c
SHA256

5d6f7cb48daf706c2d965d61df503915013c91d4cbf6e8ed26170cb66538e2c2
SHA512

940a1f2cd6eb760740b71248e7f40697c4acc5769d2af37e42d7936c58169e29576b53f5aec243081d39fc3ad55ade6d8e4400b77ecdc8ecbb144917672f4547

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Windows\CurrentVersion\Run\peace = "C:\\Windows\\WScript.exe F:\\peace.vbs"	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\5d6f7cb48daf706c2d965d61df503915013c91d4cbf6e8ed26170cb66538e2c2.vbs"
1⤵
- Adds Run key to start application
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads