Analysis

  • max time kernel
    111s
  • max time network
    120s
  • resource
    win7v191014

General

  • Target

    VBS_ae2d789d5592459429702cd490a2bf16.10

  • Sample

    191122-mqjd9gzh16

  • SHA256

    ec1c88877b2cc43eb60442e94c46c2e1e100582251e9a545a0ba9df1d5692fa3

Score
N/A

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1964
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1580
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1132
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1668
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1984
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2032
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1928
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1572
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1820
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1124
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2000
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1412
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1924
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1344
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1104
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1356
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:752
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1812
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1212
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1492
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1988
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:692
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1028
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
      PID:1128

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/692-22-0x0000000002830000-0x0000000002834000-memory.dmp

      Filesize

      16KB

    • memory/752-17-0x00000000027D0000-0x00000000027D4000-memory.dmp

      Filesize

      16KB

    • memory/1028-23-0x00000000029C0000-0x00000000029C4000-memory.dmp

      Filesize

      16KB

    • memory/1104-15-0x0000000002810000-0x0000000002814000-memory.dmp

      Filesize

      16KB

    • memory/1124-9-0x0000000002800000-0x0000000002804000-memory.dmp

      Filesize

      16KB

    • memory/1132-2-0x0000000002750000-0x0000000002754000-memory.dmp

      Filesize

      16KB

    • memory/1212-19-0x0000000002910000-0x0000000002914000-memory.dmp

      Filesize

      16KB

    • memory/1344-14-0x00000000028E0000-0x00000000028E4000-memory.dmp

      Filesize

      16KB

    • memory/1356-16-0x00000000029E0000-0x00000000029E4000-memory.dmp

      Filesize

      16KB

    • memory/1412-11-0x00000000029D0000-0x00000000029D4000-memory.dmp

      Filesize

      16KB

    • memory/1492-20-0x0000000002950000-0x0000000002954000-memory.dmp

      Filesize

      16KB

    • memory/1572-7-0x0000000002850000-0x0000000002854000-memory.dmp

      Filesize

      16KB

    • memory/1580-1-0x0000000002900000-0x0000000002904000-memory.dmp

      Filesize

      16KB

    • memory/1668-3-0x0000000002A20000-0x0000000002A24000-memory.dmp

      Filesize

      16KB

    • memory/1812-18-0x00000000027D0000-0x00000000027D4000-memory.dmp

      Filesize

      16KB

    • memory/1816-13-0x0000000002950000-0x0000000002954000-memory.dmp

      Filesize

      16KB

    • memory/1820-8-0x00000000029D0000-0x00000000029D4000-memory.dmp

      Filesize

      16KB

    • memory/1924-12-0x00000000027C0000-0x00000000027C4000-memory.dmp

      Filesize

      16KB

    • memory/1928-6-0x0000000002710000-0x0000000002714000-memory.dmp

      Filesize

      16KB

    • memory/1964-0-0x0000000002830000-0x0000000002834000-memory.dmp

      Filesize

      16KB

    • memory/1984-4-0x00000000027A0000-0x00000000027A4000-memory.dmp

      Filesize

      16KB

    • memory/1988-21-0x0000000002920000-0x0000000002924000-memory.dmp

      Filesize

      16KB

    • memory/2000-10-0x0000000002990000-0x0000000002994000-memory.dmp

      Filesize

      16KB

    • memory/2032-5-0x0000000002A00000-0x0000000002A04000-memory.dmp

      Filesize

      16KB