5e2cc6dc7d37d53aeb48b54ec95d1a6d18d5c40a1dbdc95041d2c343a83731c6 | Triage

Analysis

max time kernel
92s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
25/06/2024, 22:00 UTC

Sharing

Report Analysis Logs

General

Target

file01.vbs
Size

24KB
MD5

6bb95a2276b3d2311eb096c88f6440ae
SHA1

38c51027ea2f613eef4b953429fa37291aaad1bd
SHA256

5e2cc6dc7d37d53aeb48b54ec95d1a6d18d5c40a1dbdc95041d2c343a83731c6
SHA512

d73a886a48b24d8240e635af40ae0fe5c4ccddaa9fa62232a2e2ac941671eec01bf8e8ab5569aa3ea6612cd1148a09f13ede494b1043a0fb8269339e06bb2bd8
SSDEEP

384:Ca18m4jIrR16rWHIBEDNMthSq0z4/873I8WctpwZPgv:718m4jC16rgIB6Mthau873bVtpwZPgv

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
2	4708	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file01.vbs"
1⤵
- Blocklisted process makes network request
PID:4708

Network

DNS

198.148.167.72.host.secureserver.net

WScript.exe

Remote address:

8.8.8.8:53

Request

198.148.167.72.host.secureserver.net

IN A

Response

198.148.167.72.host.secureserver.net

IN A

72.167.148.198
DNS

31.243.111.52.in-addr.arpa

WScript.exe

Remote address:

8.8.8.8:53

Request

31.243.111.52.in-addr.arpa

IN PTR

Response

72.167.148.198:443

198.148.167.72.host.secureserver.net

WScript.exe

260 B
5
52.111.227.13:443

322 B
7

8.8.8.8:53

198.148.167.72.host.secureserver.net

dns

WScript.exe

154 B
256 B
2
2

DNS Request

198.148.167.72.host.secureserver.net

DNS Response

72.167.148.198

DNS Request

31.243.111.52.in-addr.arpa

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads