37592e4c0b1ed1f83461dc3c76091a60a76bd527026ee5563bc0ea7da02771f5

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25-09-2024 17:36

Target

ipras.vbs
Size

126B
MD5

b802ff9244875f69db2fae0f78e92b10
SHA1

49385a89cd575894a29fbda969b99cc1f5cf8076
SHA256

a1b0cb16fb2ecd66fccf156024404801ad694056e8a596326c1b27b57d8eabe8
SHA512

609856415a7ae2b3e260f945f1c8a8d2a28884c202d37181bea948708918f24b42ae03f17dba1520fddc91b2f7a182b0b8f885f33ea6f81bb3ee4c72e4e9350e

Score

8^/10

Blocklisted process makes network request 2 IoCs

flow	pid	Process
4	2668	WScript.exe
6	2668	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

flow	ioc
3	iplogger.org
4	iplogger.org

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ipras.vbs"
1⤵
- Blocklisted process makes network request
PID:2668

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact