3cc03de0ddea408c9411f50251d308c51e21f1df7a39d8fba70620696c87eb5b | Triage

Analysis

max time kernel
131s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 17:09

Sharing

Report Analysis Logs

General

Target

file.vbs
Size

126B
MD5

270a3db0d6ca46a7b78f004f78b6ff04
SHA1

094d82c47b3b7710373ff32c29f60b4cb81f68c8
SHA256

0b9613013bbbe305bb638b9fbfd6ccbbdb2a99980301c82ee9884ce1f95cf763
SHA512

d78b772b5bbeb96ea59c34886901c9523bd6009335bbd8695c92ce9ba09513b2286090e99da0d4c9b773e1def72d8fcdf57dbe641dfad2bad7e09bd59d6113dd

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

5 3644 WScript.exe
7 3644 WScript.exe
12 3644 WScript.exe
14 3644 WScript.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

4 iplogger.org
5 iplogger.org

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file.vbs"
1⤵
- Blocklisted process makes network request
PID:3644

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...