074d64caca3fb9276fd87d20283dfec88d2b4e7efaa77a3b656511b3f8488e09

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

script.vbs
Size

3KB
MD5

c98a4bfd30b5a314670dda412ee3b469
SHA1

1c02bc28c5a7f03fc0145ceab806f89920141c7c
SHA256

074d64caca3fb9276fd87d20283dfec88d2b4e7efaa77a3b656511b3f8488e09
SHA512

79cb9d54c84b2cfe46287845746646b1b034d50572ce92c2c5ab893a4bb5f499c916c3a71fa56cce0fa74f9ee437482fbb3d083edefa361cfc5d419f0790749f

Score

8^/10

evasion

Malware Config

Signatures

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WScript.exe

Disables Task Manager via registry modification
evasion
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2756 wrote to memory of 2440	2756	WScript.exe	29
PID 2756 wrote to memory of 2440	2756	WScript.exe	29
PID 2756 wrote to memory of 2440	2756	WScript.exe	29

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\script.vbs"
1⤵
- Disables RegEdit via registry modification
- Suspicious use of WriteProcessMemory
PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...