Analysis

  • max time kernel
    152s
  • max time network
    149s
  • resource
    win10v191014

General

  • Target

    VBS_ae2d789d5592459429702cd490a2bf16.10

  • Sample

    191122-slcs4b65ye

  • SHA256

    ec1c88877b2cc43eb60442e94c46c2e1e100582251e9a545a0ba9df1d5692fa3

Score
N/A

Malware Config

Signatures

  • Checks system information in the registry (likely anti-VM) 2 TTPs 2 IoCs
  • Windows security modification 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Drops file in system dir 5 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4960
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5028
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4104
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:300
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4292
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4504
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3972
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3236
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4612
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4736
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3760
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4348
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4272
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3900
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2720
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4180
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4116
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:512
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4860
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2924
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4812
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4584
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3564
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4964
  • C:\Windows\System32\wscript.exe
    "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\document7806.vbe.vbs ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___- ___-
    1⤵
      PID:5104
    • C:\Windows\system32\SppExtComObj.exe
      C:\Windows\system32\SppExtComObj.exe -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1892
    • C:\Windows\System32\SLUI.exe
      "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
      1⤵
        PID:360
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s BITS
        1⤵
        • Drops file in system dir
        PID:4196
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
        1⤵
          PID:4252
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s DoSvc
          1⤵
          • Checks system information in the registry (likely anti-VM)
          PID:4080
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s wscsvc
          1⤵
          • Windows security modification
          • Suspicious use of WriteProcessMemory
          PID:4112
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k unistacksvcgroup
          1⤵
            PID:4152
          • C:\Program Files\Windows Defender\mpcmdrun.exe
            "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
            1⤵
              PID:4848

            Network

            MITRE ATT&CK Enterprise v15

            MITRE ATT&CK Additional techniques

            • T1089

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/4960-0-0x0000025B6E390000-0x0000025B6E491000-memory.dmp

              Filesize

              1.0MB