Analysis
-
max time kernel
67s -
max time network
55s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 11:43
General
-
Target
winfps.vbs
-
Size
219B
-
MD5
07098fbce3e75c642d1590678b7ea9f7
-
SHA1
760735f7e8daf1d39e70c240ed7928049b95ab70
-
SHA256
db1d9d073c374281d4d0ab8be32258b2804e234bfc8cbf348855a36cc08f6768
-
SHA512
e4bdfa2c3a7d6ae8d5919ac598370200aa14e7dfdb01a0511232d47ad2ab8b2816bd0644c7cbaea267fcaa80eed8333a3c114ffcdbe66d117d230c4bf62a2d33
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\winfps.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c start /b C:\Users\Public\frp_0.57.0_windows_amd64\frpc.exe -c C:\Users\Public\frp_0.57.0_windows_amd64\frpc.ini2⤵
-