22b2fce0f300353468c409cb80f363ccd1a9c0e5355d0cc834b9bc47dbfbb973

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_48_/3.vbs
Size

3KB
MD5

7899e062addf0fa130391b411cb5d2ab
SHA1

47409486665bd92727de559cd84cde1f645fac0f
SHA256

9af6cfdad42e0d280da99ac890747266ddf1af0255a940ba82f16226bb9aed19
SHA512

f222df9d1166d50adb9fb7e7a03b60efc6fc0a2f0235242346d5041870db275255c82bb51030447dd0f44097f83cb98f3c2e4d7511a479b98fed20cb6b82d6ac

Score

4^/10

Malware Config

Signatures

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\NetMeeting\ie.html	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2220	2360	WScript.exe	28
PID 2360 wrote to memory of 2220	2360	WScript.exe	28
PID 2360 wrote to memory of 2220	2360	WScript.exe	28
PID 2360 wrote to memory of 2676	2360	WScript.exe	30
PID 2360 wrote to memory of 2676	2360	WScript.exe	30
PID 2360 wrote to memory of 2676	2360	WScript.exe	30
PID 2676 wrote to memory of 1644	2676	cmd.exe	32
PID 2676 wrote to memory of 1644	2676	cmd.exe	32
PID 2676 wrote to memory of 1644	2676	cmd.exe	32
PID 2676 wrote to memory of 2296	2676	cmd.exe	33
PID 2676 wrote to memory of 2296	2676	cmd.exe	33
PID 2676 wrote to memory of 2296	2676	cmd.exe	33

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2220	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\$_48_\3.vbs"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" "C:\Program Files\NetMeeting\ie.html" +R
  2⤵
  - Views/modifies file attributes
  PID:2220
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y| cacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:1644
- - C:\Windows\system32\cacls.exe
    cacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R
    3⤵
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads