3a4fdb3a9b8a659cc336159f9473b70d747c22a357920e8052b9621f2a789310 | Triage

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
05-05-2024 14:40

Sharing

Report Analysis Logs

General

Target

InterVpn/bin/InterVpn/qwesy.vbs
Size

126B
MD5

fdbd7d32368ea4853f5405f41b581c95
SHA1

8fde7d4aaa07860bc42f477b75e4065839dfe8cb
SHA256

0993886554b84d9c1633659e08da86a90a7da266e92aca15d5fa71ed9dd2589a
SHA512

db760f966ddc1a776efddbca7cdac79137c2afbd71c5263d5cb53e6ee8786969dbb024abfc9a15725fef6b4961710f687dfc4209f0cb1f8c55c9e36ed2aa3ecf

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

WScript.exe

flow pid process

6 3568 WScript.exe
8 3568 WScript.exe
10 3568 WScript.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 iplogger.org
6 iplogger.org

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\InterVpn\bin\InterVpn\qwesy.vbs"
1⤵
- Blocklisted process makes network request
PID:3568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...