83186e69b7f2a4aa4681f73eafbc403c1c26a471a0eb6868054dc907d17261ce

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 17:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.vbs
Size

1KB
MD5

e9a758b44a248fbba654830895394512
SHA1

e6a1f744dbd8325f91996b63f6193666c123aba2
SHA256

83186e69b7f2a4aa4681f73eafbc403c1c26a471a0eb6868054dc907d17261ce
SHA512

984157742da2cad278cc352eeb4ff324c5d4cece30c9907cccf4adb9ffe57d0e77bc120d6af34703704d8492da5da0a8206a927bca13de762c90d0178b1f20ad

Score

7^/10

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\startup.vbs	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2520	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2520	taskkill.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2520	2992	WScript.exe	28
PID 2992 wrote to memory of 2520	2992	WScript.exe	28
PID 2992 wrote to memory of 2520	2992	WScript.exe	28

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:1580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:1556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\penis_5.txt

Filesize
3B

MD5
ba73ad5fc2ed01c25a420738836e432d

SHA1
c7b82e264bfc6fc76696100258a7eeade8175f66

SHA256
780b590e823368f04ff6782eee4e506bd5f504460cf797c02180b4569a64cd03

SHA512
55cef1f54fee7ad89f5b0ac1ca509fb6cd47a5f23af8ef87b65d471ec22de7f7d78788d1b3710355c78272c85729c3ee413e650991820c2c60198d62a2d65d26

Download Submit