Analysis
-
max time kernel
134s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
23-05-2024 01:28
General
-
Target
Aventia_AS_002600.vbs
-
Size
73KB
-
MD5
453e9aaf18526533a0f039baeaa79082
-
SHA1
b189a02057f6b1457f5dc83f2d58ed4fb0fa3372
-
SHA256
bf55c23767ad3981da15d4789452b9738b018e840de160697b754d49e2853761
-
SHA512
5c1d2e33fe95a10bc6ee7aa89fe932f976b96bcd7d93cb98af2c24a6b15b5f1a14a4346458310071ce47d340ccb51214a3868b846c62667dbba165b01c96d285
-
SSDEEP
1536:raCCZDbSV8CeDYUrTqgNQSGu7PEkvbGLSOSGn4tqabynRkbY/Mu4SbfIkaktmjfo:GN6V8CeDYUrTqqQSGu7PEkvbGLSOSGnl
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Aventia_AS_002600.vbs"1⤵
-
C:\Windows\system32\cmd.execmd.exe /c ren C:\Users\Admin\AppData\Local\Temp\ImageView.txt svchost.exe &C:\Users\Admin\AppData\Local\Temp/svchost.exe1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx