Analysis

  • max time kernel
    109s
  • max time network
    122s
  • resource
    win7v191014

General

  • Target

    VBS_ae2d789d5592459429702cd490a2bf16.7

  • Sample

    191122-dvqflt1kfx

  • SHA256

    ec1c88877b2cc43eb60442e94c46c2e1e100582251e9a545a0ba9df1d5692fa3

Score
N/A

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1368
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:920
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1980
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1452
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1228
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1900
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1108
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:788
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1960
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1880
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1252
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1128
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1384
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2028
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1476
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1984
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:792
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1956
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1520
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2008
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2024
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1028
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
      PID:2032

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/788-8-0x0000000002AA0000-0x0000000002AA4000-memory.dmp

      Filesize

      16KB

    • memory/792-18-0x0000000002960000-0x0000000002964000-memory.dmp

      Filesize

      16KB

    • memory/920-2-0x0000000002930000-0x0000000002934000-memory.dmp

      Filesize

      16KB

    • memory/1028-23-0x0000000002990000-0x0000000002994000-memory.dmp

      Filesize

      16KB

    • memory/1104-1-0x0000000002A20000-0x0000000002A24000-memory.dmp

      Filesize

      16KB

    • memory/1108-7-0x00000000028C0000-0x00000000028C4000-memory.dmp

      Filesize

      16KB

    • memory/1128-12-0x0000000002890000-0x0000000002894000-memory.dmp

      Filesize

      16KB

    • memory/1228-5-0x0000000002820000-0x0000000002824000-memory.dmp

      Filesize

      16KB

    • memory/1252-11-0x00000000027F0000-0x00000000027F4000-memory.dmp

      Filesize

      16KB

    • memory/1368-0-0x00000000028F0000-0x00000000028F4000-memory.dmp

      Filesize

      16KB

    • memory/1384-14-0x0000000002810000-0x0000000002814000-memory.dmp

      Filesize

      16KB

    • memory/1452-4-0x0000000002940000-0x0000000002944000-memory.dmp

      Filesize

      16KB

    • memory/1476-16-0x0000000002900000-0x0000000002904000-memory.dmp

      Filesize

      16KB

    • memory/1520-20-0x0000000002870000-0x0000000002874000-memory.dmp

      Filesize

      16KB

    • memory/1880-10-0x0000000002930000-0x0000000002934000-memory.dmp

      Filesize

      16KB

    • memory/1900-6-0x0000000002880000-0x0000000002884000-memory.dmp

      Filesize

      16KB

    • memory/1956-19-0x0000000002860000-0x0000000002864000-memory.dmp

      Filesize

      16KB

    • memory/1960-9-0x00000000028B0000-0x00000000028B4000-memory.dmp

      Filesize

      16KB

    • memory/1980-3-0x0000000002870000-0x0000000002874000-memory.dmp

      Filesize

      16KB

    • memory/1984-17-0x0000000002760000-0x0000000002764000-memory.dmp

      Filesize

      16KB

    • memory/2008-21-0x0000000002850000-0x0000000002854000-memory.dmp

      Filesize

      16KB

    • memory/2020-13-0x0000000002A30000-0x0000000002A34000-memory.dmp

      Filesize

      16KB

    • memory/2024-22-0x00000000027B0000-0x00000000027B4000-memory.dmp

      Filesize

      16KB

    • memory/2028-15-0x0000000002AD0000-0x0000000002AD4000-memory.dmp

      Filesize

      16KB