Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 09:17

General

  • Target

    Accelya NDC SPRK Platform.vbs

  • Size

    2.2MB

  • MD5

    1fb5432583a1e8c36b9cec2020fff30b

  • SHA1

    02262b1241e01214530773f37cea0d91492fcc88

  • SHA256

    4a929263e46f217558b7085c3b62527408a58dbfa94f53405eb10c2546bf93dd

  • SHA512

    afb373f2fdecb1e0c0144b01db229dad910d8af63391b4061fac4fe5e152cc9941b5a74377103546c7f0c186112556f547064b607ba297b3a3b684243c4bea72

  • SSDEEP

    24576:zvvVTbDQjG+xjhxmG88vshdnSxmKrmJhMTu9i9CbkmvV6wImsUoS+oVYtZVLwg2S:zvJunstR6wIB2WtLaDP5O

Score
10/10

Malware Config

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Accelya NDC SPRK Platform.vbs"
    1⤵
      PID:2620
    • C:\Windows\system32\cmd.exe
      cmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Accelya NDC SPRK Platform.vbs.exe" /Y
      1⤵
      • Process spawned unexpected child process
      PID:2636

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\Accelya NDC SPRK Platform.vbs.exe

            Filesize

            442KB

            MD5

            92f44e405db16ac55d97e3bfe3b132fa

            SHA1

            04c5d2b4da9a0f3fa8a45702d4256cee42d8c48d

            SHA256

            6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7

            SHA512

            f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f