Analysis
-
max time kernel
129s -
max time network
151s -
resource
win10v191014
Task
task1
Sample
VBS_ae2d789d5592459429702cd490a2bf16.5.zip
Resource
win7v191014
0 signatures
Task
task2
Sample
VBS_ae2d789d5592459429702cd490a2bf16.5.zip
Resource
win10v191014
0 signatures
Task
task3
Sample
document7806.vbe.vbs
Resource
win7v191014
0 signatures
Task
task4
Sample
document7806.vbe.vbs
Resource
win10v191014
0 signatures
General
-
Target
VBS_ae2d789d5592459429702cd490a2bf16.5
-
Sample
191122-qr87nkb7la
-
SHA256
ec1c88877b2cc43eb60442e94c46c2e1e100582251e9a545a0ba9df1d5692fa3
Score
N/A
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 4940 wrote to memory of 5008 4940 WScript.exe 72 PID 5008 wrote to memory of 5080 5008 wscript.exe 73 PID 5080 wrote to memory of 2012 5080 wscript.exe 74 PID 2012 wrote to memory of 388 2012 wscript.exe 75 PID 388 wrote to memory of 3056 388 wscript.exe 76 PID 3056 wrote to memory of 4080 3056 wscript.exe 77 PID 4080 wrote to memory of 3816 4080 wscript.exe 78 PID 3816 wrote to memory of 3212 3816 wscript.exe 79 PID 3212 wrote to memory of 4640 3212 wscript.exe 80 PID 4640 wrote to memory of 1428 4640 wscript.exe 81 PID 1428 wrote to memory of 4348 1428 wscript.exe 83 PID 4348 wrote to memory of 4328 4348 wscript.exe 84 PID 4328 wrote to memory of 4340 4328 wscript.exe 85 PID 4340 wrote to memory of 2940 4340 wscript.exe 86 PID 2940 wrote to memory of 4140 2940 wscript.exe 87 PID 4140 wrote to memory of 4132 4140 wscript.exe 88 PID 4132 wrote to memory of 3468 4132 wscript.exe 89 PID 3468 wrote to memory of 4856 3468 wscript.exe 90 PID 4856 wrote to memory of 540 4856 wscript.exe 91 PID 540 wrote to memory of 4812 540 wscript.exe 92 PID 4812 wrote to memory of 4948 4812 wscript.exe 94 PID 4968 wrote to memory of 5060 4968 SppExtComObj.exe 95 PID 4948 wrote to memory of 5084 4948 wscript.exe 96 PID 5084 wrote to memory of 1788 5084 wscript.exe 97 PID 1788 wrote to memory of 348 1788 wscript.exe 98 -
Drops file in system dir 5 IoCs
description ioc pid Process File opened for modification C:\Windows\Debug\ESE.TXT 4524 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4524 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp 4524 svchost.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4524 svchost.exe File created C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-2.tmp 4524 svchost.exe -
Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
description ioc pid Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer 4128 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName 4128 svchost.exe -
description ioc pid Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "0" 4868 svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\cval = "1" 4868 svchost.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:4940
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5008
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5080
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:2012
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:388
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3056
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4080
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3816
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3212
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4640
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:1428
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4348
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4328
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4340
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:2940
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4140
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4132
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:3468
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4856
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:540
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4812
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:4968
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:4948
-
C:\Windows\System32\SLUI.exe"C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent1⤵PID:5060
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:5084
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵
- Suspicious use of WriteProcessMemory
PID:1788
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-1⤵PID:348
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Drops file in system dir
PID:4524
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV1⤵PID:2116
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DoSvc1⤵
- Checks system information in the registry (likely anti-VM)
PID:4128
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup1⤵PID:3680
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc1⤵
- Windows security modification
PID:4868
Network
MITRE ATT&CK Enterprise v15
MITRE ATT&CK Additional techniques
- T1089