ae5b66322e5a7c26ad21ccc556bdc1618796166565d2939142c5aa3d76c38ace | Triage

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-07-2024 04:39

Sharing

Report Analysis Logs

General

Target

wscripts/service-remove.vbs
Size

150B
MD5

b90e75dd7903cb2d6328bb3714865c7a
SHA1

2d32868deb198726ed5feb80b66542bad7fbacee
SHA256

970b3c2a9ea1906a177810990478932e3517f47aba267cf2ab9e4ba65e7b475f
SHA512

3d4bfb86ec98fd85843ae5b63dcf5f475c6500380f02bb4d0dee15a5f7e2334abdbbcd9420b8ac05b5beb8a63b9ea16abcd70ae01c04b87a423fc288ff4dca0a

Score

8^/10

evasion execution

Malware Config

Signatures

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2456	sc.exe
1248	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2456	2232	WScript.exe	28
PID 2232 wrote to memory of 2456	2232	WScript.exe	28
PID 2232 wrote to memory of 2456	2232	WScript.exe	28
PID 2232 wrote to memory of 1248	2232	WScript.exe	30
PID 2232 wrote to memory of 1248	2232	WScript.exe	30
PID 2232 wrote to memory of 1248	2232	WScript.exe	30

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wscripts\service-remove.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" stop Parsec
  2⤵
  - Launches sc.exe
  PID:2456
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" delete Parsec
  2⤵
  - Launches sc.exe
  PID:1248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Replay Monitor

Loading Replay Monitor...

Downloads