c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6

Analysis

max time kernel
149s
max time network
105s
platform
windows11-21h2_x64
resource
win11-20251015-en
resource tags

arch:x64arch:x86image:win11-20251015-enlocale:en-usos:windows11-21h2-x64system
submitted
04/11/2025, 15:47

Target
c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6.vbs
Size 528B
Sample251104-s76nvscv5d
SHA256 c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6
MD5 3d62d69e5bc96ae100b6a98182745841
SHA1 89339f6f0a0775ca6020db67d5e1261924c9abca
SHA512 02a9d85b0e9d1e8e10f8df89f620c5a72fa1aa7c0361461a45c7005e7dc74828460910e45d4ccc8d779cedf0665d5c9826219e6e10a335272ef7e16529598f9d
MD5 SHA1 SHA512

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 4104	400	WScript.exe	82
PID 400 wrote to memory of 4104	400	WScript.exe	82
PID 4104 wrote to memory of 5368	4104	cmd.exe	84
PID 4104 wrote to memory of 5368	4104	cmd.exe	84
PID 400 wrote to memory of 5160	400	WScript.exe	85
PID 400 wrote to memory of 5160	400	WScript.exe	85

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\c2d2320ae43aaa0798cbcec163a0265cba511f8d42d90d45cd49a43fe1c40be6.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c tar -xf "C:\Users\Admin\AppData\Local\Temp\Lib.zip" -C "C:\Users\Admin\AppData\Local\Temp"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\tar.exe
    tar -xf "C:\Users\Admin\AppData\Local\Temp\Lib.zip" -C "C:\Users\Admin\AppData\Local\Temp"
    3⤵
    PID:5368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ppp.exe nvidia.py
  2⤵
  PID:5160

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact