90efa2e75e2102942fba13cb4a5744530cd85e84fcfc8d7ddccdc17081ac3f69

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 18:30

Target

4d11fae42476a363ad9cc2eeeea038ef.vbs
Size

783B
MD5

4d11fae42476a363ad9cc2eeeea038ef
SHA1

8f9b65f448924c79fe7a19b6fdf9a965c1de8371
SHA256

90efa2e75e2102942fba13cb4a5744530cd85e84fcfc8d7ddccdc17081ac3f69
SHA512

cf828788c7e7c0cd119a308b5f4ed705aa6007ac318f0fdf6f8e6696b2ed376f1bfec0ccd7d16771f868f8f84bd36442d827d84781d699cdc2d0f8a6e5c35883

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exenet.exe

description	pid	process	target process
PID 2812 wrote to memory of 1896	2812	WScript.exe	net.exe
PID 2812 wrote to memory of 1896	2812	WScript.exe	net.exe
PID 2812 wrote to memory of 1896	2812	WScript.exe	net.exe
PID 1896 wrote to memory of 2816	1896	net.exe	net1.exe
PID 1896 wrote to memory of 2816	1896	net.exe	net1.exe
PID 1896 wrote to memory of 2816	1896	net.exe	net1.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\4d11fae42476a363ad9cc2eeeea038ef.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\System32\net.exe
"C:\Windows\System32\net.exe" session
2⤵
- Suspicious use of WriteProcessMemory
PID:1896

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance