3d0c53b85d752355b9185c5d43a96dc028f2a56e73fb3358dc6a7f0882329e4e | Triage

Analysis

max time kernel
135s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 12:11

Sharing

Report Analysis Logs

General

Target

Setup1.vbs
Size

126B
MD5

3ffc26d751f79fb801ecbb715885e852
SHA1

f54da1552aabfbf68ef07fa98234a8a1ff789a16
SHA256

8816d2a6adff6e256c6f478c46b283991feeb28dedc384914fe35f14f673d5d6
SHA512

08e00923d92f9141ec09ed420738126883772e359e6fc2e703a293020d0bb42b915d2a9961ba03676ab2ad43d8f4563b46778e119f22007073b1d9f1124c0d24

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

4 1204 WScript.exe
6 1204 WScript.exe
8 1204 WScript.exe
10 1204 WScript.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

3 iplogger.org
4 iplogger.org

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Setup1.vbs"
1⤵
- Blocklisted process makes network request
PID:1204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...