Analysis

  • max time kernel
    110s
  • max time network
    120s
  • resource
    win7v191014

General

  • Target

    VBS_ae2d789d5592459429702cd490a2bf16.6

  • Sample

    191122-542c13s88x

  • SHA256

    ec1c88877b2cc43eb60442e94c46c2e1e100582251e9a545a0ba9df1d5692fa3

Score
N/A

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2032
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1364
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1504
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1652
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1888
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1072
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:752
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1996
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1752
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1892
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1008
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2004
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2040
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:304
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1236
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1300
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:112
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1392
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1320
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:316
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
      PID:2008

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/112-18-0x0000000002850000-0x0000000002854000-memory.dmp

      Filesize

      16KB

    • memory/304-15-0x0000000002910000-0x0000000002914000-memory.dmp

      Filesize

      16KB

    • memory/316-23-0x0000000002780000-0x0000000002784000-memory.dmp

      Filesize

      16KB

    • memory/752-7-0x00000000028B0000-0x00000000028B4000-memory.dmp

      Filesize

      16KB

    • memory/1008-12-0x0000000002840000-0x0000000002844000-memory.dmp

      Filesize

      16KB

    • memory/1072-6-0x0000000002900000-0x0000000002904000-memory.dmp

      Filesize

      16KB

    • memory/1096-11-0x00000000027C0000-0x00000000027C4000-memory.dmp

      Filesize

      16KB

    • memory/1192-1-0x0000000002920000-0x0000000002924000-memory.dmp

      Filesize

      16KB

    • memory/1236-16-0x00000000028B0000-0x00000000028B4000-memory.dmp

      Filesize

      16KB

    • memory/1300-17-0x0000000002A60000-0x0000000002A64000-memory.dmp

      Filesize

      16KB

    • memory/1320-22-0x0000000002970000-0x0000000002974000-memory.dmp

      Filesize

      16KB

    • memory/1364-2-0x0000000002990000-0x0000000002994000-memory.dmp

      Filesize

      16KB

    • memory/1392-21-0x0000000002800000-0x0000000002804000-memory.dmp

      Filesize

      16KB

    • memory/1504-3-0x0000000002880000-0x0000000002884000-memory.dmp

      Filesize

      16KB

    • memory/1652-4-0x0000000002A20000-0x0000000002A24000-memory.dmp

      Filesize

      16KB

    • memory/1752-9-0x00000000028A0000-0x00000000028A4000-memory.dmp

      Filesize

      16KB

    • memory/1888-5-0x00000000029E0000-0x00000000029E4000-memory.dmp

      Filesize

      16KB

    • memory/1892-10-0x0000000002890000-0x0000000002894000-memory.dmp

      Filesize

      16KB

    • memory/1900-20-0x00000000027A0000-0x00000000027A4000-memory.dmp

      Filesize

      16KB

    • memory/1996-8-0x0000000002790000-0x0000000002794000-memory.dmp

      Filesize

      16KB

    • memory/2000-19-0x0000000002810000-0x0000000002814000-memory.dmp

      Filesize

      16KB

    • memory/2004-13-0x00000000028F0000-0x00000000028F4000-memory.dmp

      Filesize

      16KB

    • memory/2032-0-0x0000000002AA0000-0x0000000002AA4000-memory.dmp

      Filesize

      16KB

    • memory/2040-14-0x00000000028B0000-0x00000000028B4000-memory.dmp

      Filesize

      16KB