Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:17
Static task
static1
Behavioral task
behavioral1
Sample
Accelya NDC SPRK Platform.vbs
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Accelya NDC SPRK Platform.vbs
Resource
win10v2004-20240802-en
General
-
Target
Accelya NDC SPRK Platform.vbs
-
Size
2.2MB
-
MD5
1fb5432583a1e8c36b9cec2020fff30b
-
SHA1
02262b1241e01214530773f37cea0d91492fcc88
-
SHA256
4a929263e46f217558b7085c3b62527408a58dbfa94f53405eb10c2546bf93dd
-
SHA512
afb373f2fdecb1e0c0144b01db229dad910d8af63391b4061fac4fe5e152cc9941b5a74377103546c7f0c186112556f547064b607ba297b3a3b684243c4bea72
-
SSDEEP
24576:zvvVTbDQjG+xjhxmG88vshdnSxmKrmJhMTu9i9CbkmvV6wImsUoS+oVYtZVLwg2S:zvJunstR6wIB2WtLaDP5O
Malware Config
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2636 2812 cmd.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Accelya NDC SPRK Platform.vbs"1⤵PID:2620
-
C:\Windows\system32\cmd.execmd /c copy "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "C:\Users\Admin\AppData\Local\Temp\Accelya NDC SPRK Platform.vbs.exe" /Y1⤵
- Process spawned unexpected child process
PID:2636
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
442KB
MD592f44e405db16ac55d97e3bfe3b132fa
SHA104c5d2b4da9a0f3fa8a45702d4256cee42d8c48d
SHA2566c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7
SHA512f7d85cfb42a4d859d10f1f06f663252be50b329fcf78a05bb75a263b55235bbf8adb89d732935b1325aaea848d0311ab283ffe72b19db93e6c28a859204fdf9f