fb6212a24b852abd2f91ff18b5a94ee61708d361dabeb25e897b4819b183a2e5

Analysis

max time kernel
110s
max time network
66s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

run.vbs
Size

1KB
MD5

a58f28c134caf2d2da2431c8d62e6ace
SHA1

54351ce11379b7e9eca691d4a00027d73de50510
SHA256

fb6212a24b852abd2f91ff18b5a94ee61708d361dabeb25e897b4819b183a2e5
SHA512

3bcae33e770364de07edc6542d69bdb2713aa2d888f3a16742c456d725f288249c01be4ff1d28cbab1382a6a16e5450047c00c19441be757573c15f5a5ac09d6

Score

8^/10

evasion

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe

Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2364	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2756	2896	WScript.exe	28
PID 2896 wrote to memory of 2756	2896	WScript.exe	28
PID 2896 wrote to memory of 2756	2896	WScript.exe	28
PID 2896 wrote to memory of 2364	2896	WScript.exe	32
PID 2896 wrote to memory of 2364	2896	WScript.exe	32
PID 2896 wrote to memory of 2364	2896	WScript.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\run.vbs"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mkdir "C:\Users\YourUsername\Desktop\TextFiles"
  2⤵
  PID:2756
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im svchost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:1576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads