Analysis
- max time kernel
46s - max time network
66s - platform
windows10_x64 - resource
win10v20210408 - submitted
04/07/2021, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
Payment Invoice.vbs
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Payment Invoice.vbs
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target Payment Invoice.vbs
- Size 823KB
- Sample210704-2dnh2dj7fs
- SHA256 dab48eb20191f37e19aed12dc58640ab40957cec26dc3fa63a88f70decbd875c
- MD5 f7ffee57fe4046630ee32cfda7c1b657
- SHA1 2041357ca9a677f09aab6a5b8c802e5faf253bc1
- SHA512 2b2bd3d11c07b5689beabbb7eb149ab1e60150a92c946154cd1d8ce9a2dcce49f787dd74c5c09a1eec944207d30e337e2108e79ee8e9a0543ee57ce06ab6db46
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 5 IoCs
pid Process 3992 tmp.exe 3908 A.scr 3196 A.scr 2656 baox.exe 2772 baox.exe -
resource yara_rule behavioral2/files/0x000300000001ab3d-118.dat upx behavioral2/files/0x000300000001ab3d-119.dat upx behavioral2/files/0x000300000001ab3d-124.dat upx behavioral2/files/0x000100000001ab46-127.dat upx behavioral2/files/0x000100000001ab46-128.dat upx behavioral2/files/0x000400000001ab42-132.dat upx behavioral2/files/0x000100000001ab46-135.dat upx - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce tmp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" tmp.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3908 set thread context of 3196 3908 A.scr 79 PID 2656 set thread context of 2772 2656 baox.exe 82 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3908 A.scr 3908 A.scr 2656 baox.exe 2656 baox.exe 2772 baox.exe 2772 baox.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeSecurityPrivilege 3196 A.scr - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3908 A.scr 2656 baox.exe - Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 516 wrote to memory of 3992 516 WScript.exe 74 PID 516 wrote to memory of 3992 516 WScript.exe 74 PID 516 wrote to memory of 3992 516 WScript.exe 74 PID 3992 wrote to memory of 3908 3992 tmp.exe 76 PID 3992 wrote to memory of 3908 3992 tmp.exe 76 PID 3992 wrote to memory of 3908 3992 tmp.exe 76 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3908 wrote to memory of 3196 3908 A.scr 79 PID 3196 wrote to memory of 2656 3196 A.scr 81 PID 3196 wrote to memory of 2656 3196 A.scr 81 PID 3196 wrote to memory of 2656 3196 A.scr 81 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2656 wrote to memory of 2772 2656 baox.exe 82 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 1348 2772 baox.exe 83 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 2772 wrote to memory of 3196 2772 baox.exe 79 PID 3196 wrote to memory of 3912 3196 A.scr 84 PID 3196 wrote to memory of 3912 3196 A.scr 84 PID 3196 wrote to memory of 3912 3196 A.scr 84
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Payment Invoice.vbs"1⤵
- Suspicious use of WriteProcessMemory
PID:516 -
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A.scrC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A.scr3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A.scrC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\A.scr4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Roaming\Xuhiod\baox.exe"C:\Users\Admin\AppData\Roaming\Xuhiod\baox.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Roaming\Xuhiod\baox.exeC:\Users\Admin\AppData\Roaming\Xuhiod\baox.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"7⤵PID:1348
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmpa3e84282.bat"5⤵PID:3912
-
-
-
-