ae59d36e53ec379202de90b7cea9d0b61e91e896555397fbdd7f395c56c80e9d

Analysis

max time kernel
496s
max time network
1587s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
25/06/2024, 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virga_sim.vbs
Size

8KB
MD5

abfc83452621ad6ee2c369de90e50e73
SHA1

692055e1b6261ab3f741e421b99a078e9873bd5a
SHA256

ae59d36e53ec379202de90b7cea9d0b61e91e896555397fbdd7f395c56c80e9d
SHA512

381581af3b259e7a155af493735aa5852718081004e511e6ef80c9b1d740241af1931889690d1c725ed4cc09eb44c84f53d38c90da2d90e43d253c2eeb0ab08e
SSDEEP

96:WtYIOJAOwO6JpiPJr6TWLKRY/lqebulNxtZ0jFQELUWFwbSPCzPghKNugn/EAmAc:OXTJxOxOJRYaFtyWELPgKGYalyJqf6

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	380	WScript.exe
Token: SeCreatePagefilePrivilege	380	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\virga_sim.vbs"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit