Analysis
-
max time kernel
122s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 09:06
Static task
static1
Behavioral task
behavioral1
Sample
af4bb34b486434d235ff70d344e3fa4e6d56a83705e1cc288efe219edceded06.vbs
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
af4bb34b486434d235ff70d344e3fa4e6d56a83705e1cc288efe219edceded06.vbs
Resource
win10v2004-en-20220112
General
-
Target
af4bb34b486434d235ff70d344e3fa4e6d56a83705e1cc288efe219edceded06.vbs
-
Size
162KB
-
MD5
c3c90a58ff247a052529de56f29ecf3c
-
SHA1
aa62c39357984dfa208c1ff7a0b76dc200c37b4d
-
SHA256
af4bb34b486434d235ff70d344e3fa4e6d56a83705e1cc288efe219edceded06
-
SHA512
6427d3abddaf44ce8d11fe686cfdf3d0fddfe9c910da406416da646aaf172d4514dbbd1419b8c2ea6fce13c538beee22b8c46adb6a4360c4d3626ba65f9d02f3
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 768 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
WScript.exedescription pid process target process PID 1900 wrote to memory of 768 1900 WScript.exe powershell.exe PID 1900 wrote to memory of 768 1900 WScript.exe powershell.exe PID 1900 wrote to memory of 768 1900 WScript.exe powershell.exe
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\af4bb34b486434d235ff70d344e3fa4e6d56a83705e1cc288efe219edceded06.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eXEcUTiONpOLicY rEmOtEsIgNeD -FILE C:\Users\Admin\AppData\Local\Temp\OS64Bits.PS12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\OS64Bits.PS1MD5
0572153c45a42e89a900e12008b17df6
SHA1dcc2cb82ddce82d1d6b1b7fc3d7143b4b1b3bffc
SHA256560cf733ab631e245bab376b9563d33f61376f99ef7a3a772abca6ef95c75d1b
SHA512096bc3866773dd6feb978c0fed1596d08e3636584feaaad7c7db887410ffa6da4c453c5b82fe001d882e237a951884b1b747642cb43c8325ec1ba70aecff6fce
-
memory/768-58-0x000007FEF5A9E000-0x000007FEF5A9F000-memory.dmpFilesize
4KB
-
memory/768-59-0x0000000002840000-0x0000000002842000-memory.dmpFilesize
8KB
-
memory/768-60-0x0000000002842000-0x0000000002844000-memory.dmpFilesize
8KB
-
memory/768-61-0x0000000002844000-0x0000000002847000-memory.dmpFilesize
12KB
-
memory/768-57-0x000007FEF3370000-0x000007FEF3ECD000-memory.dmpFilesize
11.4MB
-
memory/768-63-0x000000000284B000-0x000000000286A000-memory.dmpFilesize
124KB
-
memory/1900-55-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmpFilesize
8KB