159cecd0dd4bf6e1d3307ac453f1c78cc688c1064450104605da772a03913b05

Analysis

max time kernel
135s
max time network
9s
platform
windows7_x64
resource
win7v200722
submitted
22-10-2020 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

O365/OffScrubC2R.vbs
Size

284KB
MD5

930dc88edcdde90f7449ca55aa616928
SHA1

e3ae471e645efe2beb61c8d6febe8a1bebf9a2ad
SHA256

570f82344ad7300dd4a2993ad6c3a1abe1987f37254bff708dba1801bfef392c
SHA512

d3f1bcfd409988d366b06563c2c5d27a1c7cdabaf4fc47a6d13d0a54b13931dbf340b1eabf2eeffecd0e982cd563792f6d91d779826657becad989050019ed38

Score

8^/10

persistence spyware

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies service 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas	explorer.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs	explorer.exe

Modifies registry class 10 IoCs

Processes:

explorer.exeexplorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-403932158-3302036622-1224131197-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Runs net.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1984 explorer.exe

pid	process
1984	explorer.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

explorer.exeexplorer.exe

description	pid	process
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1040	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe
Token: SeShutdownPrivilege	1984	explorer.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

explorer.exeexplorer.exe

pid	process
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe

Suspicious use of SendNotifyMessage 44 IoCs

Processes:

explorer.exeexplorer.exe

pid	process
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1040	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe
1984	explorer.exe

Suspicious use of WriteProcessMemory 93 IoCs

Processes:

WScript.execmd.execscript.execmd.exenet.exe

description	pid	process	target process
PID 1076 wrote to memory of 1920	1076	WScript.exe	cmd.exe
PID 1076 wrote to memory of 1920	1076	WScript.exe	cmd.exe
PID 1076 wrote to memory of 1920	1076	WScript.exe	cmd.exe
PID 1920 wrote to memory of 1860	1920	cmd.exe	cscript.exe
PID 1920 wrote to memory of 1860	1920	cmd.exe	cscript.exe
PID 1920 wrote to memory of 1860	1920	cmd.exe	cscript.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 944	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 944	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 944	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 596	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 596	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 596	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1700	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1700	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1700	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1752	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 528	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 528	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 528	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1184	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1184	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1184	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 640	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 640	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 640	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1460	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1460	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1460	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1552	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1552	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1552	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1428	1860	cscript.exe	cmd.exe
PID 1860 wrote to memory of 1428	1860	cscript.exe	cmd.exe
PID 1860 wrote to memory of 1428	1860	cscript.exe	cmd.exe
PID 1428 wrote to memory of 936	1428	cmd.exe	net.exe
PID 1428 wrote to memory of 936	1428	cmd.exe	net.exe
PID 1428 wrote to memory of 936	1428	cmd.exe	net.exe
PID 936 wrote to memory of 2028	936	net.exe	net1.exe
PID 936 wrote to memory of 2028	936	net.exe	net1.exe
PID 936 wrote to memory of 2028	936	net.exe	net1.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1048	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 2040	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1468	1860	cscript.exe	schtasks.exe
PID 1860 wrote to memory of 1544	1860	cscript.exe	schtasks.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\O365\OffScrubC2R.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1076

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\O365\OffScrubC2R.vbs" "/ChangedScriptHost"
2⤵
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\System32\cscript.exe
C:\Windows\System32\cscript.exe //NOLOGO "C:\Users\Admin\AppData\Local\Temp\O365\OffScrubC2R.vbs" "/ChangedScriptHost"
3⤵
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDstreamSchedule /F
4⤵
PID:1468

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDUPDATEDETECTION /F
4⤵
PID:1752

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN C2RAppVLoggingStart /F
4⤵
PID:944

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office 15 Subscription Heartbeat" /F
4⤵
PID:596

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" /F
4⤵
PID:1048

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentFallBack" /F
4⤵
PID:2040

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentFallBack" /F
4⤵
PID:1700

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentLogOn" /F
4⤵
PID:1752

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentLogOn" /F
4⤵
PID:528

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office Background Streaming" /F
4⤵
PID:1184

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office Automatic Updates" /F
4⤵
PID:640

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office ClickToRun Service Monitor" /F
4⤵
PID:1460

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office Subscription Maintenance" /F
4⤵
PID:1552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c net stop msiserver
4⤵
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\system32\net.exe
net stop msiserver
5⤵
- Suspicious use of WriteProcessMemory
PID:936

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop msiserver
6⤵
PID:2028

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDstreamSchedule /F
4⤵
PID:1048

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN FF_INTEGRATEDUPDATEDETECTION /F
4⤵
PID:2040

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN C2RAppVLoggingStart /F
4⤵
PID:1468

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office 15 Subscription Heartbeat" /F
4⤵
PID:1544

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Microsoft Office 15 Sync Maintenance for {d068b555-9700-40b8-992c-f866287b06c1}" /F
4⤵
PID:936

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentFallBack" /F
4⤵
PID:1940

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentFallBack" /F
4⤵
PID:1772

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeInventoryAgentLogOn" /F
4⤵
PID:1436

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\OfficeTelemetryAgentLogOn" /F
4⤵
PID:1508

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office Background Streaming" /F
4⤵
PID:1556

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office Automatic Updates" /F
4⤵
PID:852

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "\Microsoft\Office\Office ClickToRun Service Monitor" /F
4⤵
PID:1696

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Office Subscription Maintenance" /F
4⤵
PID:2032

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1040

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies service
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1984

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/528-13-0x0000000000000000-mapping.dmp

Download
memory/596-8-0x0000000000000000-mapping.dmp

Download
memory/640-15-0x0000000000000000-mapping.dmp

Download
memory/852-38-0x0000000000000000-mapping.dmp

Download
memory/936-32-0x0000000000000000-mapping.dmp

Download
memory/936-19-0x0000000000000000-mapping.dmp

Download
memory/944-6-0x0000000000000000-mapping.dmp

Download
memory/1048-9-0x0000000000000000-mapping.dmp

Download
memory/1048-28-0x0000000000000000-mapping.dmp

Download
memory/1076-42-0x0000000002700000-0x0000000002704000-memory.dmp

Filesize
16KB

Download
memory/1184-14-0x0000000000000000-mapping.dmp

Download
memory/1428-18-0x0000000000000000-mapping.dmp

Download
memory/1436-35-0x0000000000000000-mapping.dmp

Download
memory/1460-16-0x0000000000000000-mapping.dmp

Download
memory/1468-4-0x0000000000000000-mapping.dmp

Download
memory/1468-30-0x0000000000000000-mapping.dmp

Download
memory/1508-36-0x0000000000000000-mapping.dmp

Download
memory/1544-31-0x0000000000000000-mapping.dmp

Download
memory/1552-17-0x0000000000000000-mapping.dmp

Download
memory/1556-37-0x0000000000000000-mapping.dmp

Download
memory/1696-39-0x0000000000000000-mapping.dmp

Download
memory/1700-11-0x0000000000000000-mapping.dmp

Download
memory/1752-5-0x0000000000000000-mapping.dmp

Download
memory/1752-12-0x0000000000000000-mapping.dmp

Download
memory/1772-34-0x0000000000000000-mapping.dmp

Download
memory/1860-1-0x0000000000000000-mapping.dmp

Download
memory/1860-41-0x00000000025F0000-0x00000000025F4000-memory.dmp

Filesize
16KB

Download
memory/1920-0-0x0000000000000000-mapping.dmp

Download
memory/1940-33-0x0000000000000000-mapping.dmp

Download
memory/1984-2-0x0000000003CF0000-0x0000000003CF1000-memory.dmp

Filesize
4KB

Download
memory/1984-7-0x00000000050E0000-0x0000000005384000-memory.dmp

Filesize
2.6MB

Download
memory/2028-20-0x0000000000000000-mapping.dmp

Download
memory/2032-40-0x0000000000000000-mapping.dmp

Download
memory/2040-29-0x0000000000000000-mapping.dmp

Download
memory/2040-10-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads