32ab1d25825f510b8be2bfd73a48d6539db914a9382726dd486be114f6ccae6e

Analysis

max time kernel
1406s
max time network
1172s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
12-10-2024 07:08

Target

wscripts/legacy-cleanup.vbs
Size

115B
MD5

c78520c3162c1962f3164714b37eb4d0
SHA1

67c19b8aea7ad99465976dbcd3efcfdd7d62e3fe
SHA256

dea38bd553abe93c689de42d0220add18f9be3e3d2fa53f97eb8649f586df4f3
SHA512

cfbfc2c7dd8019f98b77e8881680ef9d0135a210fb9b0136a4992c236d971e247aa1641cd2eafdc5f6f5bb61002b30ea14b226127c4cef04f3b3d6be3a941fcc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3596 wrote to memory of 3204	3596	WScript.exe	80
PID 3596 wrote to memory of 3204	3596	WScript.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wscripts\legacy-cleanup.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:3596
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn ParsecTeams /f
  2⤵
  PID:3204

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact