b5b88dd1fec437dc02bd7cd69c9639a931634ab1c2ecc62f5869e6985d8a4508

Analysis

max time kernel
438s
max time network
1161s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
11/09/2024, 13:47

Target

7.vbs
Size

141B
MD5

684398f7e2fd50d00042339a7008f566
SHA1

45a28ec014657476ce12237e9928d21367a5ba52
SHA256

b5b88dd1fec437dc02bd7cd69c9639a931634ab1c2ecc62f5869e6985d8a4508
SHA512

6330fd2f56e066a6dd9c095856e39199c4ee190094f48df48a32c3d3ccc1e37fc08153d7798fb3e48c609ac3e748cd833be72007d943f4b165952c96cb4e598a

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 5048	1376	WScript.exe	79
PID 1376 wrote to memory of 5048	1376	WScript.exe	79

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\7.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe"
  2⤵
  PID:5048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3320

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact