d4e22efe33f6e7efe8949460d43be2ee850930ac5818c0071ab8cd909cb4523d

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 20:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

code.vbs
Size

642B
MD5

d56b8338d67b5b32af99fabcff84743c
SHA1

5d91d677bfcc592342b533eb120fab513f3b4136
SHA256

d4e22efe33f6e7efe8949460d43be2ee850930ac5818c0071ab8cd909cb4523d
SHA512

dfcb09b81d7a62972a8bfeca78e611efc7c922ddab32c971fed5f6e05b822139ef6d322183ca0852a5fbf875e575c1792a4c5f4d5521d2086ace988a067e0d79

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2976	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2976	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2664	1492	WScript.exe	28
PID 1492 wrote to memory of 2664	1492	WScript.exe	28
PID 1492 wrote to memory of 2664	1492	WScript.exe	28
PID 1492 wrote to memory of 2616	1492	WScript.exe	30
PID 1492 wrote to memory of 2616	1492	WScript.exe	30
PID 1492 wrote to memory of 2616	1492	WScript.exe	30
PID 1492 wrote to memory of 2712	1492	WScript.exe	32
PID 1492 wrote to memory of 2712	1492	WScript.exe	32
PID 1492 wrote to memory of 2712	1492	WScript.exe	32
PID 1492 wrote to memory of 2812	1492	WScript.exe	34
PID 1492 wrote to memory of 2812	1492	WScript.exe	34
PID 1492 wrote to memory of 2812	1492	WScript.exe	34
PID 1492 wrote to memory of 552	1492	WScript.exe	36
PID 1492 wrote to memory of 552	1492	WScript.exe	36
PID 1492 wrote to memory of 552	1492	WScript.exe	36
PID 1492 wrote to memory of 2484	1492	WScript.exe	38
PID 1492 wrote to memory of 2484	1492	WScript.exe	38
PID 1492 wrote to memory of 2484	1492	WScript.exe	38
PID 1492 wrote to memory of 2556	1492	WScript.exe	40
PID 1492 wrote to memory of 2556	1492	WScript.exe	40
PID 1492 wrote to memory of 2556	1492	WScript.exe	40
PID 1492 wrote to memory of 2884	1492	WScript.exe	42
PID 1492 wrote to memory of 2884	1492	WScript.exe	42
PID 1492 wrote to memory of 2884	1492	WScript.exe	42
PID 1492 wrote to memory of 1180	1492	WScript.exe	44
PID 1492 wrote to memory of 1180	1492	WScript.exe	44
PID 1492 wrote to memory of 1180	1492	WScript.exe	44
PID 1492 wrote to memory of 2548	1492	WScript.exe	46
PID 1492 wrote to memory of 2548	1492	WScript.exe	46
PID 1492 wrote to memory of 2548	1492	WScript.exe	46
PID 1492 wrote to memory of 2792	1492	WScript.exe	48
PID 1492 wrote to memory of 2792	1492	WScript.exe	48
PID 1492 wrote to memory of 2792	1492	WScript.exe	48
PID 1492 wrote to memory of 2100	1492	WScript.exe	50
PID 1492 wrote to memory of 2100	1492	WScript.exe	50
PID 1492 wrote to memory of 2100	1492	WScript.exe	50
PID 1492 wrote to memory of 2240	1492	WScript.exe	52
PID 1492 wrote to memory of 2240	1492	WScript.exe	52
PID 1492 wrote to memory of 2240	1492	WScript.exe	52
PID 1492 wrote to memory of 1932	1492	WScript.exe	54
PID 1492 wrote to memory of 1932	1492	WScript.exe	54
PID 1492 wrote to memory of 1932	1492	WScript.exe	54
PID 1492 wrote to memory of 800	1492	WScript.exe	56
PID 1492 wrote to memory of 800	1492	WScript.exe	56
PID 1492 wrote to memory of 800	1492	WScript.exe	56
PID 1492 wrote to memory of 1988	1492	WScript.exe	58
PID 1492 wrote to memory of 1988	1492	WScript.exe	58
PID 1492 wrote to memory of 1988	1492	WScript.exe	58
PID 1492 wrote to memory of 1720	1492	WScript.exe	60
PID 1492 wrote to memory of 1720	1492	WScript.exe	60
PID 1492 wrote to memory of 1720	1492	WScript.exe	60
PID 1492 wrote to memory of 1992	1492	WScript.exe	62
PID 1492 wrote to memory of 1992	1492	WScript.exe	62
PID 1492 wrote to memory of 1992	1492	WScript.exe	62
PID 1492 wrote to memory of 2284	1492	WScript.exe	64
PID 1492 wrote to memory of 2284	1492	WScript.exe	64
PID 1492 wrote to memory of 2284	1492	WScript.exe	64
PID 1492 wrote to memory of 808	1492	WScript.exe	66
PID 1492 wrote to memory of 808	1492	WScript.exe	66
PID 1492 wrote to memory of 808	1492	WScript.exe	66
PID 1492 wrote to memory of 2456	1492	WScript.exe	68
PID 1492 wrote to memory of 2456	1492	WScript.exe	68
PID 1492 wrote to memory of 2456	1492	WScript.exe	68
PID 1492 wrote to memory of 1088	1492	WScript.exe	70

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\code.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2664
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2616
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2712
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2812
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:552
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2484
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2556
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2884
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1180
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2548
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2792
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2100
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2240
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1932
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:800
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1988
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1720
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1992
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2284
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:808
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2456
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1088
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1644
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1752
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:2200
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:536
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1100
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1472
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:540
- C:\Windows\System32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Roaming\what.bat" "
  2⤵
  PID:1280
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\what.bat

Filesize
138B

MD5
22daf7675069fd1357b39383b8644f8f

SHA1
6a7b3097021897cd55b48d16ea8e548e085a4f31

SHA256
1b357376ed2cdf28d86f7f9a56b509f02f5d1efa43df0028d04873901228e773

SHA512
7f1152a982419baf844b33d78538cb37223bb7e357fbc2e2501214d977a3c9388dbc194c899610d4f0d1dbe48b38a0e1a0c95156439457d8c04a637f7fd092be

Download Submit