2b49ca21dd645edd3d08709a68f205cc59bcc2a48b8b3ba49815fdceefbb1c4e

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

$PLUGINSDIR/pcpc.vbs
Size

910B
MD5

03e3b03acfb4900c61ec54c07e9a6834
SHA1

f6d1cb731fb3bc69ad2fad90874ab73895915aee
SHA256

a3d17e06945cd044a9b2a13dab8f4ca7d2f309bb564fbfcea5c1e570f82aff89
SHA512

19d59a1df2d6222dd685b2c5912d09b280fdcf134494f77d61923b233be5c5a7892262a514a4e38955ba2f8af1715be1340f7544e56668b0681014409ee64239

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	WScript.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2728	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\pcpc.vbs"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...