79f16938bfbb43225489e05d8b75dc982720f723a07318623e7d638633f8237a

Analysis

max time kernel
14s
max time network
20s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 08:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$_48_/qq.vbs
Size

1KB
MD5

73290cf237739a717d6635cce6863ae4
SHA1

ce8b179f95bb23f63d9620aed1984245c4e78713
SHA256

77dce01c2086e7fbba95de7beaef12e8e7ef848563e5a7e31d8faed1d01676c2
SHA512

b5e91821ed63157b898cc599e504614bbc160a6f056f6c396789dbc3af2a0c2ebb97707830b2d4187be0a83e458a2a2ebd38efe409b708433a170f996abb5e7e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2248	2132	WScript.exe	29
PID 2132 wrote to memory of 2248	2132	WScript.exe	29
PID 2132 wrote to memory of 2248	2132	WScript.exe	29
PID 2132 wrote to memory of 2172	2132	WScript.exe	31
PID 2132 wrote to memory of 2172	2132	WScript.exe	31
PID 2132 wrote to memory of 2172	2132	WScript.exe	31
PID 2172 wrote to memory of 2876	2172	cmd.exe	33
PID 2172 wrote to memory of 2876	2172	cmd.exe	33
PID 2172 wrote to memory of 2876	2172	cmd.exe	33
PID 2172 wrote to memory of 2932	2172	cmd.exe	34
PID 2172 wrote to memory of 2932	2172	cmd.exe	34
PID 2172 wrote to memory of 2932	2172	cmd.exe	34

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2248	attrib.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\$_48_\qq.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\System32\attrib.exe
  "C:\Windows\System32\attrib.exe" "C:\Program Files\NetMeeting\ie.html" +R
  2⤵
  - Views/modifies file attributes
  PID:2248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo Y| cacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:2876
- - C:\Windows\system32\cacls.exe
    cacls "C:\Program Files\NetMeeting\ie.html" /P Everyone:R
    3⤵
    PID:2932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads