Analysis
-
max time kernel
122s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
05-05-2024 12:56
Static task
static1
Behavioral task
behavioral1
Sample
file.vbs
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.vbs
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
file.vbs
-
Size
2KB
-
MD5
0b892419b6889fd88f52b6499c495ada
-
SHA1
b7495596ee43bf281fd9979f7ec48402676c547e
-
SHA256
6b7ee926a8648096d7b3b53816248d70da573fd3ced5a3501859b9f64afd13d4
-
SHA512
a35a1fa6fc9f8e939729d31a867eff2d82a8758276bb3015c92b0189dee43e680816b29674374457de49ebfd6a9a077dc114b87d7c54d7f12fd12f50f6325c26
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 684 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1016 taskmgr.exe Token: SeSystemProfilePrivilege 1016 taskmgr.exe Token: SeCreateGlobalPrivilege 1016 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe -
Suspicious use of SendNotifyMessage 47 IoCs
pid Process 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe 1016 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3640 wrote to memory of 684 3640 WScript.exe 82 PID 3640 wrote to memory of 684 3640 WScript.exe 82 PID 3640 wrote to memory of 1704 3640 WScript.exe 98 PID 3640 wrote to memory of 1704 3640 WScript.exe 98 PID 3640 wrote to memory of 4880 3640 WScript.exe 99 PID 3640 wrote to memory of 4880 3640 WScript.exe 99 PID 3640 wrote to memory of 576 3640 WScript.exe 109 PID 3640 wrote to memory of 576 3640 WScript.exe 109
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\System32\ipconfig.exeipconfig2⤵
- Gathers network information
PID:684
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1704
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:4880
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:576
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1016