c246054359eb47b2dbb6768941ba69274d593fd1a6a9a7378ec4cbf2f656b2f8

General

Target
Suivi-de-Votre-Colis-.vbs
Size 10KB
Sample261102-pk4dfaws3k
SHA256 c246054359eb47b2dbb6768941ba69274d593fd1a6a9a7378ec4cbf2f656b2f8
MD5 5ffb9f94703893808675838aff352ad6
SHA1 88f31a56ef607c05882a4e7627187c7f5c20b39c
SHA512 41e4fa80216e180647b91f4d2c1266c5876e2ca7061ee014221f725bbca751b08165370e27833d2669487b8d9dc70d253d30934e88ee09cf4db5026032234dbc
SSDEEP 192:/r8TlkLSqvpUNFu5ZMRJDqyHiK28cQUdCcKLYJPjBJPjaUeOZOHV:/rY+3pqYXMRJDqyHiK28zyCcKQPjPxs1
TLSH
T1A232525C1110920D14609BE14C6BE48D649AA2F69BCA19FC43F3FE0C37DDDE5A8A52BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Suivi-de-Votre-Colis-.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Suivi-de-Votre-Colis-.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Suivi-de-Votre-Colis-.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Suivi-de-Votre-Colis-.vbs	WScript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\PX1ZWDU7C3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Suivi-de-Votre-Colis-.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\PX1ZWDU7C3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Suivi-de-Votre-Colis-.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\PX1ZWDU7C3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Suivi-de-Votre-Colis-.vbs\""	WScript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\PX1ZWDU7C3 = "\"C:\\Users\\Admin\\AppData\\Roaming\\Suivi-de-Votre-Colis-.vbs\""	WScript.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 4 IoCs

execution

Visual Basic

T1059.005

pid	Process
2420	WScript.exe
4844	WScript.exe
2104	WScript.exe
2704	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WScript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WScript.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5720	schtasks.exe
3524	schtasks.exe
2740	schtasks.exe
1964	schtasks.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1964	2420	WScript.exe	88
PID 4844 wrote to memory of 5720	4844	WScript.exe	95
PID 2104 wrote to memory of 3524	2104	WScript.exe	96
PID 2704 wrote to memory of 2740	2704	WScript.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Suivi-de-Votre-Colis-.vbs"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1964

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5720

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3524

C:\Windows\System32\WScript.exe
C:\Windows\System32\WScript.exe "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Executes a VBScript file via the Windows Script Host.
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /sc minute /mo 1 /tn Skype /tr "C:\Users\Admin\AppData\Roaming\Suivi-de-Votre-Colis-.vbs
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2740