Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
19/03/2024, 05:08
General
-
Target
d5475002d7df4177a826a1d378523662.vbs
-
Size
11KB
-
MD5
d5475002d7df4177a826a1d378523662
-
SHA1
2a954786814c35bc4e813281941b30ccc04d2ede
-
SHA256
f28650e1d85b3ee7b514bf8213ff5087eff05488db2c4bf841a17e8f61d202bf
-
SHA512
bc8c6abab6d79eadfb4d6859c76329d05ccbe226ff213503925582ac3e92176a944b84861a1733f19183f73371412dc84de647ca4f1b2840e86d8227d0565fdb
-
SSDEEP
192:cnaw/17v7u9arZKrZ4irZvB5+692oUw4mueWhie0aW4:k317v7u9AQ4YKw2lw4mueFOW4
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
-
Disables cmd.exe use via registry modification 1 IoCs
-
Sets file execution options in registry 2 TTPs 16 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Modifies registry class 15 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: AddClipboardFormatListener 2 IoCs
-
Suspicious use of SetWindowsHookEx 7 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
System policy modification 1 TTPs 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\d5475002d7df4177a826a1d378523662.vbs"1⤵
- Modifies visibility of file extensions in Explorer
- Disables cmd.exe use via registry modification
- Sets file execution options in registry
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "%1" /o "%u" ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\System32\reg.exe"C:\Windows\System32\reg.exe" DELETE HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /va /f2⤵
- Modifies registry key
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD568280c94f2b24d53abb16b2bd77f3370
SHA118b395a64644f4816d32d4a5c240a312b404b8ec
SHA25632d60ec986538da53896b848f18f0ecd9ce41f1e6c9c64077050cc0645516a51
SHA512f526c810adeb3b4dd32ddaf7ab6625d0d04aaa2720e2edea54af4722552f9ec9991061b2a30e84212eb9c1afcf2f37bd32df9618451d5a68c953812c22bc282e
-
Filesize
11KB
MD544a79cb61bbd7d29ce5eba06276962fe
SHA1eed86b815d72cf60ddc480b521f63eccbed3e523
SHA256aa94cf47eb4e2f0a7d624d2f9edc0ae8b63991661b4a63df63943f82646bcd42
SHA512b4aef5b8ea42ef9637530946786b72170cabda674938a9355f1ac42cf096550e4152a3ec16552bab856e0638565735765ca5f4250cc2db8eff7ed1821dc929de
-
Filesize
11KB
MD5d5475002d7df4177a826a1d378523662
SHA12a954786814c35bc4e813281941b30ccc04d2ede
SHA256f28650e1d85b3ee7b514bf8213ff5087eff05488db2c4bf841a17e8f61d202bf
SHA512bc8c6abab6d79eadfb4d6859c76329d05ccbe226ff213503925582ac3e92176a944b84861a1733f19183f73371412dc84de647ca4f1b2840e86d8227d0565fdb
-
Filesize
11KB
MD5f35721a674af9da4babc7643f3013533
SHA1ea49a33bf6354935acecb670c9ab37d4bf71c0c0
SHA256ae593044d9e8443cdcd49f131c5055ea71ab70635e65e7c79cb9ae7ce2c28217
SHA5129aa019f73bbfa7d0a36f4b7d0ae1574f0f80f4c27040f18680c82bc552ba473c380fc3bbe29cdc626f6f89ac4932f8ee56ef1609df36e3de5989026adb6c9714
-
Filesize
11KB
MD553225ce39577bd646f238d8518df0cf1
SHA10a208c9c54ea2bb444660507537435168af18793
SHA2563227a56ad58910c798a27a9aa28a27b6f00546b1152a1b75d148467273a70e75
SHA512323b92922051181cd974416340c4716dafd3f422c022b3755341f232f70dcd091902d1c89fac6c37db7057d3660b135c75b630abead9a652742330c6453d5094
-
Filesize
11KB
MD514688293a46b400e05b53b66e6543473
SHA1086ca024ca3782df8986427343ea6a60fa320e0b
SHA256e9adb7a4767ad61b492e77ae17fae3d989409517f4fcd2f1510e4e4cc7670bc2
SHA512aed02f31603edcfcb7932b536266751c4db012572d803175ad2da7ed9ade08fe3b9b7f5193a270164ac5a3656bcd2eec32c3c5f4dde576f132b77c39837c1f81
-
Filesize
11KB
MD51b10ccf2749f936dc72fd0c774b1d77d
SHA14eaf8566deb83a3a9724719b4be4fc303b4046be
SHA2561c31f9f1b263094992266c402869883da6dd4164c476bcf8efb82e8210f4653e
SHA512660396caadc2dde6a0692fb530e7cf7067cc007effc56e18b0be22118f2d6ec78aa2c18fe6999fe2b857f12ac5b7ab534b79309df525ed6eb9b75c7b44fa3eee
-
Filesize
11KB
MD5effebe9ca5cc869eb0aaac06dfd25c2b
SHA1dc929dc142491fa64f13f4d07a7c352bad82c787
SHA2560174f78b4d4ad9902ecd48d7504929b66dc57129295721a498e2e3ecc9e68eb8
SHA5121d1302f14d98ebf429a99c038c4523f3b8c6311f1dbe64c7686580e144a8c98bc6ac3e4faf642d7126a991d41236c7d58adc693c87c014758fe46258288658de
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB