Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/11/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
beyonce.vbs
Resource
win11-20241007-en
4 signatures
150 seconds
General
-
Target
beyonce.vbs
-
Size
4KB
-
MD5
e43694e61bbeeaa50527b9c6ba381a94
-
SHA1
6bfeeadbfa46833477ee497d5f7da15a878cda3b
-
SHA256
d7660e5e17722831ffbf26869f7a9b7de29740fb08268c129518026cd3ccd34e
-
SHA512
c716ccad863b6d74274ac2b134075c0af1dd93ce7e43b07a5724b07b003b8de9e15e2760358ecd660a183c442deb602462d08d2cdbeae5cb60125e0398216607
-
SSDEEP
96:i3hIZ1dmCFIQkjtWoGzxlpJRF06/nRODsPQ6/nWP56/nF6/n6:dZu07ClGzjp66/ROD8Q6/656/F6/6
Score
5/10
Malware Config
Signatures
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Control Panel\Desktop\Wallpaper = "https://i.imgur.com/hqqJrDz.jpg" WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Control Panel\Desktop WScript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2584844841-1405471295-1760131749-1000\Control Panel\Desktop\WallpaperStyle = "2" WScript.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4632 wrote to memory of 4972 4632 WScript.exe 79 PID 4632 wrote to memory of 4972 4632 WScript.exe 79 PID 4632 wrote to memory of 4496 4632 WScript.exe 80 PID 4632 wrote to memory of 4496 4632 WScript.exe 80
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\beyonce.vbs"1⤵
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters2⤵PID:4972
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" user32.dll,UpdatePerUserSystemParameters2⤵PID:4496
-