b92b2b4cac45231f8e8105a13b0d95f8997fd6e936c0bc712e5bc86a9b109ad1

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

trigger.vbs
Size

1KB
MD5

6a1f32674e0f60fd94e5b660cb518ae7
SHA1

15e5fa5e75008d286cf2c320050dec94f11be18d
SHA256

b92b2b4cac45231f8e8105a13b0d95f8997fd6e936c0bc712e5bc86a9b109ad1
SHA512

df228f584aa3994c339173fea9cc8befc92d638017a51fc9909376ab8f0c7a75d54e6ebb99826c781df036e14912ceadb7e35eb886f85950453a69d8b4594a06

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 2184	2488	WScript.exe	28
PID 2488 wrote to memory of 2184	2488	WScript.exe	28
PID 2488 wrote to memory of 2184	2488	WScript.exe	28
PID 2488 wrote to memory of 2720	2488	WScript.exe	29
PID 2488 wrote to memory of 2720	2488	WScript.exe	29
PID 2488 wrote to memory of 2720	2488	WScript.exe	29
PID 2488 wrote to memory of 2892	2488	WScript.exe	31
PID 2488 wrote to memory of 2892	2488	WScript.exe	31
PID 2488 wrote to memory of 2892	2488	WScript.exe	31
PID 2488 wrote to memory of 2664	2488	WScript.exe	32
PID 2488 wrote to memory of 2664	2488	WScript.exe	32
PID 2488 wrote to memory of 2664	2488	WScript.exe	32
PID 2488 wrote to memory of 2528	2488	WScript.exe	33
PID 2488 wrote to memory of 2528	2488	WScript.exe	33
PID 2488 wrote to memory of 2528	2488	WScript.exe	33
PID 2488 wrote to memory of 2540	2488	WScript.exe	34
PID 2488 wrote to memory of 2540	2488	WScript.exe	34
PID 2488 wrote to memory of 2540	2488	WScript.exe	34
PID 2488 wrote to memory of 2996	2488	WScript.exe	35
PID 2488 wrote to memory of 2996	2488	WScript.exe	35
PID 2488 wrote to memory of 2996	2488	WScript.exe	35
PID 2488 wrote to memory of 2576	2488	WScript.exe	36
PID 2488 wrote to memory of 2576	2488	WScript.exe	36
PID 2488 wrote to memory of 2576	2488	WScript.exe	36
PID 2488 wrote to memory of 2508	2488	WScript.exe	37
PID 2488 wrote to memory of 2508	2488	WScript.exe	37
PID 2488 wrote to memory of 2508	2488	WScript.exe	37
PID 2488 wrote to memory of 2220	2488	WScript.exe	38
PID 2488 wrote to memory of 2220	2488	WScript.exe	38
PID 2488 wrote to memory of 2220	2488	WScript.exe	38
PID 2488 wrote to memory of 2624	2488	WScript.exe	39
PID 2488 wrote to memory of 2624	2488	WScript.exe	39
PID 2488 wrote to memory of 2624	2488	WScript.exe	39
PID 2488 wrote to memory of 2716	2488	WScript.exe	40
PID 2488 wrote to memory of 2716	2488	WScript.exe	40
PID 2488 wrote to memory of 2716	2488	WScript.exe	40
PID 2488 wrote to memory of 2880	2488	WScript.exe	41
PID 2488 wrote to memory of 2880	2488	WScript.exe	41
PID 2488 wrote to memory of 2880	2488	WScript.exe	41
PID 2488 wrote to memory of 2888	2488	WScript.exe	42
PID 2488 wrote to memory of 2888	2488	WScript.exe	42
PID 2488 wrote to memory of 2888	2488	WScript.exe	42

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\trigger.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2184
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2720
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2892
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2664
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2528
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2540
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2996
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2576
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2508
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2220
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2624
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2716
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\msg.vbs"
  2⤵
  PID:2880
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\f.vbs"
  2⤵
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\f.vbs

Filesize
3B

MD5
3d0bd6b5f67f726d0bdb65f88bca374c

SHA1
1b75aa24f743a80bb85cd8cc921c66f779783f1f

SHA256
ffa625f9e301bded2619003e6a2160e2abd0ec6502579786bc872845fe2610fc

SHA512
fd15db572439b800cb64afffb232125f4078a0e89fa5eabd5751bd36ff22bfc9c9d14a56f17882651e5152102585bdb848e7483c105d04f05e220d7f41ffac14

Download Submit
C:\Users\Admin\AppData\Roaming\msg.vbs

Filesize
16B

MD5
febba25969d7363536dbc8cb8f620ea8

SHA1
c2492b795c1733ccb281ae3665d38fa4713b8ebf

SHA256
d65935643c5722e229d0d68283571402c91c71edaefcf3e0d55cf44db3911272

SHA512
9cc307d3bf0d911ef434f0a4f7fcb0f66e8bef720e62ffdf75e5103d448c07d96673594990aa3a5b7a145c01f921ff3865be3ffded3662656993ad0428769a74

Download Submit
C:\Users\Admin\Desktop\ConvertToBlock.vbs

Filesize
1KB

MD5
6a1f32674e0f60fd94e5b660cb518ae7

SHA1
15e5fa5e75008d286cf2c320050dec94f11be18d

SHA256
b92b2b4cac45231f8e8105a13b0d95f8997fd6e936c0bc712e5bc86a9b109ad1

SHA512
df228f584aa3994c339173fea9cc8befc92d638017a51fc9909376ab8f0c7a75d54e6ebb99826c781df036e14912ceadb7e35eb886f85950453a69d8b4594a06

Download Submit